{"id":"CVE-2026-71253","summary":"Apache Johnzon: ClassConverter loads & static-initializes an attacker-named class from untrusted JSON","details":"Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon.\n\n\n\nClassConverter loads & static-initializes an attacker-named class from untrusted JSON.\n\n\n\n\nThis issue affects Apache Johnzon: from 1.0.0 before 2.2.0.\n\n\n\nUsers are recommended to upgrade to version 1.3.1 (javax namespace) or 2.2.0 (jakarta specification namespace), which fixes the issue.","modified":"2026-10-21T13:01:51.802180555Z","published":"2026-10-19T10:36:41.781Z","database_specific":{"cwe_ids":["CWE-470"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71253.json","cna_assigner":"apache"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71253.json"},{"type":"FIX","url":"https://github.com/apache/johnzon/commit/91e7b0d21d08d138944e2570691939739422a3d6"},{"type":"FIX","url":"https://github.com/apache/johnzon/commit/dd3d00634c746a2173a2518e882e85e8a151bf30"},{"type":"ADVISORY","url":"https://lists.apache.org/thread.html/3vgm1yo2sn9yhkvvs9lc4ro01vl3zt68"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71253"},{"type":"WEB","url":"https://repo.maven.apache.org/maven2"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/johnzon","events":[{"introduced":"3845e13be4d7e345a5df33cba82b2de87a07ca44"},{"fixed":"5c6edd556f054818527c019ba95416ae55af2373"},{"introduced":"75120baa250f8538f4c03ed67fa43583db25eadb"},{"fixed":"c29c977c41944c03c8b2eef576122717096ce79a"},{"fixed":"dd3d00634c746a2173a2518e882e85e8a151bf30"},{"fixed":"91e7b0d21d08d138944e2570691939739422a3d6"}],"database_specific":{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"2.0.0"},{"fixed":"2.2.0"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"1.0.0"},{"fixed":"1.3.1"}]},{"source":"REFERENCES_COMMIT","range":[{"fixed":"dd3d00634c746a2173a2518e882e85e8a151bf30"}]},{"source":"REFERENCES_COMMIT","range":[{"fixed":"91e7b0d21d08d138944e2570691939739422a3d6"}]}]}}],"versions":["v2.1.1","v2.1.0","v2.0.0"],"database_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["14960288908314539708249757821313598890","41319175272346572228515860379119629988","324435612962865247101228966114928420207","211500768446711017226937439758428513890"],"threshold":0.9},"id":"CVE-2026-71253-03dfcb6b","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/91e7b0d21d08d138944e2570691939739422a3d6","target":{"file":"johnzon-jsonschema/src/main/java/org/apache/johnzon/jsonschema/spi/builtin/ExclusiveMinimumValidation.java"}},{"deprecated":false,"digest":{"line_hashes":["47764211142289959538555886543919209617","104344518615704974414979945550987926605","179965631699153685448789765672145900503","104995622831084998205772799579830630216","230673125953686865827039801535538740663","21020844373406959388274187834143380005","296831693675986414303117056269953653370","86774157154992204887412623827920195596","60110523881907844767905760378119406209","209127302366590633062380774201595306540","139768027541681135639618155518105628470"],"threshold":0.9},"id":"CVE-2026-71253-0a1fd966","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/91e7b0d21d08d138944e2570691939739422a3d6","target":{"file":"johnzon-mapper/src/main/java/org/apache/johnzon/mapper/converter/ClassConverter.java"}},{"id":"CVE-2026-71253-0bb7271b","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/dd3d00634c746a2173a2518e882e85e8a151bf30","target":{"file":"johnzon-jsonschema/src/main/java/org/apache/johnzon/jsonschema/spi/builtin/IntegerValidation.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["208477919285100590477151818308666492150","87415415706794820180452076216107620121","55063732881058535956376175743644618289","240194900833547450870054038731467783358","123088450486715286579750153768800268247","25195712984829829308245369305039144130","182664547879297574068174972219052004241","283560848640541418714961335092174454074","191687689922167254241082557860740189656","70660124026401052766275556217148518857","3387279320402527492695265017818434213"]}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/91e7b0d21d08d138944e2570691939739422a3d6","target":{"file":"johnzon-jsonschema/src/main/java/org/apache/johnzon/jsonschema/spi/builtin/MultipleOfValidation.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["193593972745334765136521601019272167568","8966305432963366890039552556109359709","160726010492419478525777433411532000286","143079940480093214458376885782110268583"]},"id":"CVE-2026-71253-1f5d691d"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/91e7b0d21d08d138944e2570691939739422a3d6","target":{"file":"johnzon-jsonschema/src/main/java/org/apache/johnzon/jsonschema/spi/builtin/IntegerValidation.java","function":"create"},"deprecated":false,"digest":{"function_hash":"176157608098751719314684807270750369361","length":387},"id":"CVE-2026-71253-2863acf5"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/91e7b0d21d08d138944e2570691939739422a3d6","target":{"file":"johnzon-jsonschema/src/main/java/org/apache/johnzon/jsonschema/JsonSchemaValidatorFactory.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["264031827405610075209765069405317390994","275346162150158654612507003009302407640","137290791423286236755878369860514698336","96765048789981544097694910496538409351","197350619250861899745735531928290923098","217751099278535666299092070247218267251","278293011127666425819832883735565145835","110474236029131595012051454554397903069","190731882056054221790314886609553730934","153013549549538935520156528766191660041","219990945572362043856944395156337458258","199645452135296599613895364592659180714","190110933034276617506850125308607064815","1504640561655771562708138151313634544","84746332092385924574899911106318511742","317774845311522175865544507131416550127","183604468606892096375017198460013538475","323420506311575950016090590015598454183","163849494858593853938821777823123519801","278731258355897482449738135850617558727","53755122457410136730651008235016144376","131869911042263624811663188798337702872","139102743557695772521085976902094708256","314077085133607913336557815433131623958","269098525445189671210120300833741285835","267841474107346985948082344824628688816","332871079712536620841885205729561982257","256908657074964633602115478978613404291","55491314090345156755067599615113232157","194919560223516451808601254020706157367","263171741472007630711163559549797270650","285857598967156061725726623113195930972","124446239284611410049720785751777184209","24780885464621723985540186449936172922","211426787023661197687295242093916073829"]},"id":"CVE-2026-71253-287226c0"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/dd3d00634c746a2173a2518e882e85e8a151bf30","target":{"function":"create","file":"johnzon-jsonschema/src/main/java/org/apache/johnzon/jsonschema/spi/builtin/ExclusiveMaximumValidation.java"},"deprecated":false,"digest":{"length":450,"function_hash":"324411453962400688955270198794353557555"},"id":"CVE-2026-71253-28968e55"},{"deprecated":false,"digest":{"function_hash":"336818282498563312440249449101383522994","length":4350},"id":"CVE-2026-71253-2be7e63a","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/dd3d00634c746a2173a2518e882e85e8a151bf30","target":{"file":"johnzon-mapper/src/main/java/org/apache/johnzon/mapper/map/LazyConverterMap.java","function":"doLazyLookup"}},{"signature_version":"v1","source":"https://github.com/apache/johnzon/commit/91e7b0d21d08d138944e2570691939739422a3d6","target":{"file":"johnzon-jsonschema/src/main/java/org/apache/johnzon/jsonschema/spi/builtin/MultipleOfValidation.java","function":"create"},"deprecated":false,"digest":{"function_hash":"71239025924540784342252932903411190968","length":444},"id":"CVE-2026-71253-34085d9f","signature_type":"Function"},{"source":"https://github.com/apache/johnzon/commit/91e7b0d21d08d138944e2570691939739422a3d6","target":{"file":"johnzon-jsonschema/src/main/java/org/apache/johnzon/jsonschema/JsonSchemaValidatorFactory.java","function":"buildAdditionalPropertiesValidations"},"deprecated":false,"digest":{"length":1317,"function_hash":"206772335040452155387002534330737104709"},"id":"CVE-2026-71253-3409dd58","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"79721280148963356922165660326402124180","length":441},"id":"CVE-2026-71253-38efe9e2","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/dd3d00634c746a2173a2518e882e85e8a151bf30","target":{"file":"johnzon-jsonschema/src/main/java/org/apache/johnzon/jsonschema/spi/builtin/MaximumValidation.java","function":"create"},"deprecated":false},{"id":"CVE-2026-71253-41dd676a","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/dd3d00634c746a2173a2518e882e85e8a151bf30","target":{"function":"adapterKeys","file":"johnzon-mapper/src/main/java/org/apache/johnzon/mapper/map/LazyConverterMap.java"},"deprecated":false,"digest":{"length":614,"function_hash":"7850533752497072037559219048493862736"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/91e7b0d21d08d138944e2570691939739422a3d6","target":{"file":"johnzon-jsonschema/src/main/java/org/apache/johnzon/jsonschema/spi/builtin/MinLengthValidation.java","function":"create"},"deprecated":false,"digest":{"length":443,"function_hash":"113234686952849145744865834121635803846"},"id":"CVE-2026-71253-43d6d9f4"},{"digest":{"length":450,"function_hash":"189571834990995944522698797216083526371"},"id":"CVE-2026-71253-451a26e6","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/91e7b0d21d08d138944e2570691939739422a3d6","target":{"function":"create","file":"johnzon-jsonschema/src/main/java/org/apache/johnzon/jsonschema/spi/builtin/ExclusiveMinimumValidation.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"7850533752497072037559219048493862736","length":614},"id":"CVE-2026-71253-45b75f01","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/91e7b0d21d08d138944e2570691939739422a3d6","target":{"function":"adapterKeys","file":"johnzon-mapper/src/main/java/org/apache/johnzon/mapper/map/LazyConverterMap.java"}},{"signature_version":"v1","source":"https://github.com/apache/johnzon/commit/dd3d00634c746a2173a2518e882e85e8a151bf30","target":{"file":"johnzon-jsonschema/src/main/java/org/apache/johnzon/jsonschema/spi/builtin/MinimumValidation.java"},"deprecated":false,"digest":{"line_hashes":["1830963679123506216854691737931071932","268542831518274217136068361248822390257","259527768211126081051096569784240382309","291841959353325949938080651684851957018"],"threshold":0.9},"id":"CVE-2026-71253-47946df5","signature_type":"Line"},{"digest":{"function_hash":"336818282498563312440249449101383522994","length":4350},"id":"CVE-2026-71253-47fa4967","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/91e7b0d21d08d138944e2570691939739422a3d6","target":{"file":"johnzon-mapper/src/main/java/org/apache/johnzon/mapper/map/LazyConverterMap.java","function":"doLazyLookup"},"deprecated":false},{"target":{"file":"johnzon-jsonschema/src/main/java/org/apache/johnzon/jsonschema/spi/builtin/PatternValidation.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["66405744045142680302789008903189697137","53977735268003002455458674908333212625","317247391022720090424142823085360371153","271728299929770211075519384310260215394"]},"id":"CVE-2026-71253-4b9cb716","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/dd3d00634c746a2173a2518e882e85e8a151bf30"},{"source":"https://github.com/apache/johnzon/commit/dd3d00634c746a2173a2518e882e85e8a151bf30","target":{"file":"johnzon-jsonschema/src/main/java/org/apache/johnzon/jsonschema/spi/builtin/PatternValidation.java","function":"create"},"deprecated":false,"digest":{"length":489,"function_hash":"251648854829649108504044282181086702977"},"id":"CVE-2026-71253-5a7f62ba","signature_type":"Function","signature_version":"v1"},{"target":{"file":"johnzon-mapper/src/main/java/org/apache/johnzon/mapper/converter/ClassConverter.java"},"deprecated":false,"digest":{"line_hashes":["47764211142289959538555886543919209617","104344518615704974414979945550987926605","179965631699153685448789765672145900503","104995622831084998205772799579830630216","230673125953686865827039801535538740663","21020844373406959388274187834143380005","296831693675986414303117056269953653370","86774157154992204887412623827920195596","60110523881907844767905760378119406209","209127302366590633062380774201595306540","139768027541681135639618155518105628470"],"threshold":0.9},"id":"CVE-2026-71253-5ed4a1dd","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/dd3d00634c746a2173a2518e882e85e8a151bf30"},{"signature_version":"v1","source":"https://github.com/apache/johnzon/commit/dd3d00634c746a2173a2518e882e85e8a151bf30","target":{"file":"johnzon-jsonschema/src/main/java/org/apache/johnzon/jsonschema/spi/builtin/MaximumValidation.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["113401877191155701431530066161081998465","166466091601693619398748857155557850621","61410166162002350351741603848349563953","243224814060592126522752452717609133233"]},"id":"CVE-2026-71253-624e2d88","signature_type":"Line"},{"digest":{"line_hashes":["258977819866701303966251099536122478907","316822968906092206751933253785807025060","49421604951046365983545622273654930704","81725290250170312661039576643237540825","231547670846248466742178985437317565588","114887334622939555012005444990000217137","182664547879297574068174972219052004241","283560848640541418714961335092174454074","191687689922167254241082557860740189656","70660124026401052766275556217148518857","3387279320402527492695265017818434213"],"threshold":0.9},"id":"CVE-2026-71253-640ccb4d","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/91e7b0d21d08d138944e2570691939739422a3d6","target":{"file":"johnzon-jsonschema/src/main/java/org/apache/johnzon/jsonschema/spi/builtin/IntegerValidation.java"},"deprecated":false},{"target":{"file":"johnzon-jsonschema/src/main/java/org/apache/johnzon/jsonschema/spi/builtin/MinLengthValidation.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["103396361384399960498824302786263265592","170953605975496980155713686787864127558","174281532191605335694272149579309817750","31575272266000204613361651221607337357"]},"id":"CVE-2026-71253-696cc505","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/91e7b0d21d08d138944e2570691939739422a3d6"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/dd3d00634c746a2173a2518e882e85e8a151bf30","target":{"file":"johnzon-jsonschema/src/main/java/org/apache/johnzon/jsonschema/spi/builtin/MultipleOfValidation.java","function":"create"},"deprecated":false,"digest":{"function_hash":"71239025924540784342252932903411190968","length":444},"id":"CVE-2026-71253-6ddeb4cb"},{"target":{"file":"johnzon-jsonschema/src/main/java/org/apache/johnzon/jsonschema/spi/builtin/ExclusiveMaximumValidation.java","function":"create"},"deprecated":false,"digest":{"length":450,"function_hash":"324411453962400688955270198794353557555"},"id":"CVE-2026-71253-72eadc94","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/91e7b0d21d08d138944e2570691939739422a3d6"},{"deprecated":false,"digest":{"line_hashes":["1830963679123506216854691737931071932","268542831518274217136068361248822390257","259527768211126081051096569784240382309","291841959353325949938080651684851957018"],"threshold":0.9},"id":"CVE-2026-71253-811fa1d9","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/91e7b0d21d08d138944e2570691939739422a3d6","target":{"file":"johnzon-jsonschema/src/main/java/org/apache/johnzon/jsonschema/spi/builtin/MinimumValidation.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/91e7b0d21d08d138944e2570691939739422a3d6","target":{"file":"johnzon-jsonschema/src/main/java/org/apache/johnzon/jsonschema/spi/builtin/MaximumValidation.java"},"deprecated":false,"digest":{"line_hashes":["113401877191155701431530066161081998465","166466091601693619398748857155557850621","61410166162002350351741603848349563953","243224814060592126522752452717609133233"],"threshold":0.9},"id":"CVE-2026-71253-84f1852c"},{"target":{"file":"johnzon-jsonschema/src/main/java/org/apache/johnzon/jsonschema/spi/builtin/MaxLengthValidation.java","function":"create"},"deprecated":false,"digest":{"function_hash":"308091716957498030488566373355142771813","length":443},"id":"CVE-2026-71253-892e514c","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/91e7b0d21d08d138944e2570691939739422a3d6"},{"target":{"file":"johnzon-jsonschema/src/main/java/org/apache/johnzon/jsonschema/spi/builtin/ExclusiveMaximumValidation.java"},"deprecated":false,"digest":{"line_hashes":["301494994482083259649722369351888474850","209685955501262137006709966698793381364","327740754429922669158434608552526206479","14742639887824477379136248685891817560"],"threshold":0.9},"id":"CVE-2026-71253-89ee8c6c","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/91e7b0d21d08d138944e2570691939739422a3d6"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/dd3d00634c746a2173a2518e882e85e8a151bf30","target":{"file":"johnzon-jsonschema/src/main/java/org/apache/johnzon/jsonschema/spi/builtin/MaxLengthValidation.java"},"deprecated":false,"digest":{"line_hashes":["242729590866218701774470340298340847432","39279070899869083432392543580714551560","266724945676322546951393089602356695283","149047096426852709621051493633785210371"],"threshold":0.9},"id":"CVE-2026-71253-9333c7c0"},{"target":{"file":"johnzon-jsonschema/src/main/java/org/apache/johnzon/jsonschema/spi/builtin/MaximumValidation.java","function":"create"},"deprecated":false,"digest":{"length":441,"function_hash":"79721280148963356922165660326402124180"},"id":"CVE-2026-71253-93e221b0","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/91e7b0d21d08d138944e2570691939739422a3d6"},{"digest":{"function_hash":"189571834990995944522698797216083526371","length":450},"id":"CVE-2026-71253-9aa68634","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/dd3d00634c746a2173a2518e882e85e8a151bf30","target":{"function":"create","file":"johnzon-jsonschema/src/main/java/org/apache/johnzon/jsonschema/spi/builtin/ExclusiveMinimumValidation.java"},"deprecated":false},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["193593972745334765136521601019272167568","8966305432963366890039552556109359709","160726010492419478525777433411532000286","143079940480093214458376885782110268583"]},"id":"CVE-2026-71253-9c296510","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/dd3d00634c746a2173a2518e882e85e8a151bf30","target":{"file":"johnzon-jsonschema/src/main/java/org/apache/johnzon/jsonschema/spi/builtin/MultipleOfValidation.java"}},{"id":"CVE-2026-71253-a39d40bf","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/dd3d00634c746a2173a2518e882e85e8a151bf30","target":{"function":"create","file":"johnzon-jsonschema/src/main/java/org/apache/johnzon/jsonschema/spi/builtin/MinimumValidation.java"},"deprecated":false,"digest":{"function_hash":"199626362406657853927322438374336637237","length":441}},{"target":{"function":"create","file":"johnzon-jsonschema/src/main/java/org/apache/johnzon/jsonschema/spi/builtin/MinLengthValidation.java"},"deprecated":false,"digest":{"function_hash":"113234686952849145744865834121635803846","length":443},"id":"CVE-2026-71253-a3aceacc","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/dd3d00634c746a2173a2518e882e85e8a151bf30"},{"deprecated":false,"digest":{"line_hashes":["153267135279514526700775233292565524242","312621287230433282992157876674203821286","256364118624723123277023081722744173207","158309319488319488693879307623139830023","219603854389865276124214816743123500304","179762343716793901022768167935115503546","37265362574154855284813380318300775531","275062135583920706547409889575133320584","113232268110025199647048172372831891252","215611419079362203594267104037860152258","98988308983601015577622526207072635956","163294751233826241252325685211672788500","1339244148027085622432461033181393427","146760659823226683953896892366612683139"],"threshold":0.9},"id":"CVE-2026-71253-a7336859","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/91e7b0d21d08d138944e2570691939739422a3d6","target":{"file":"johnzon-mapper/src/main/java/org/apache/johnzon/mapper/map/LazyConverterMap.java"}},{"id":"CVE-2026-71253-ab9af634","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/dd3d00634c746a2173a2518e882e85e8a151bf30","target":{"function":"create","file":"johnzon-jsonschema/src/main/java/org/apache/johnzon/jsonschema/spi/builtin/IntegerValidation.java"},"deprecated":false,"digest":{"function_hash":"176157608098751719314684807270750369361","length":387}},{"digest":{"function_hash":"126541905795718709278600376598300209785","length":202},"id":"CVE-2026-71253-b0db6fb1","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/91e7b0d21d08d138944e2570691939739422a3d6","target":{"file":"johnzon-mapper/src/main/java/org/apache/johnzon/mapper/converter/ClassConverter.java","function":"fromString"},"deprecated":false},{"id":"CVE-2026-71253-b1dab616","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/dd3d00634c746a2173a2518e882e85e8a151bf30","target":{"file":"johnzon-jsonschema/src/main/java/org/apache/johnzon/jsonschema/spi/builtin/MaxLengthValidation.java","function":"create"},"deprecated":false,"digest":{"length":443,"function_hash":"308091716957498030488566373355142771813"}},{"deprecated":false,"digest":{"line_hashes":["264031827405610075209765069405317390994","275346162150158654612507003009302407640","137290791423286236755878369860514698336","96765048789981544097694910496538409351","197350619250861899745735531928290923098","217751099278535666299092070247218267251","278293011127666425819832883735565145835","110474236029131595012051454554397903069","190731882056054221790314886609553730934","153013549549538935520156528766191660041","219990945572362043856944395156337458258","199645452135296599613895364592659180714","190110933034276617506850125308607064815","1504640561655771562708138151313634544","84746332092385924574899911106318511742","317774845311522175865544507131416550127","183604468606892096375017198460013538475","323420506311575950016090590015598454183","163849494858593853938821777823123519801","278731258355897482449738135850617558727","53755122457410136730651008235016144376","131869911042263624811663188798337702872","139102743557695772521085976902094708256","314077085133607913336557815433131623958","269098525445189671210120300833741285835","267841474107346985948082344824628688816","332871079712536620841885205729561982257","256908657074964633602115478978613404291","55491314090345156755067599615113232157","194919560223516451808601254020706157367","263171741472007630711163559549797270650","285857598967156061725726623113195930972","124446239284611410049720785751777184209","24780885464621723985540186449936172922","211426787023661197687295242093916073829"],"threshold":0.9},"id":"CVE-2026-71253-b2493064","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/dd3d00634c746a2173a2518e882e85e8a151bf30","target":{"file":"johnzon-jsonschema/src/main/java/org/apache/johnzon/jsonschema/JsonSchemaValidatorFactory.java"}},{"digest":{"threshold":0.9,"line_hashes":["103396361384399960498824302786263265592","170953605975496980155713686787864127558","174281532191605335694272149579309817750","31575272266000204613361651221607337357"]},"id":"CVE-2026-71253-b77b84c9","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/dd3d00634c746a2173a2518e882e85e8a151bf30","target":{"file":"johnzon-jsonschema/src/main/java/org/apache/johnzon/jsonschema/spi/builtin/MinLengthValidation.java"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/dd3d00634c746a2173a2518e882e85e8a151bf30","target":{"file":"johnzon-jsonschema/src/test/java/org/apache/johnzon/jsonschema/JsonSchemaValidatorTest.java"},"deprecated":false,"digest":{"line_hashes":["47411975141698849249545666590449677596","62470577721717107480235219650389604400","134231337077490442479568020461225459517","93601544045610884627235196239027916634","146867621354344760835711855944612581280","243737491883838054122069837376836685567"],"threshold":0.9},"id":"CVE-2026-71253-ba99a1d5"},{"deprecated":false,"digest":{"line_hashes":["66405744045142680302789008903189697137","53977735268003002455458674908333212625","317247391022720090424142823085360371153","271728299929770211075519384310260215394"],"threshold":0.9},"id":"CVE-2026-71253-c0c757fd","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/91e7b0d21d08d138944e2570691939739422a3d6","target":{"file":"johnzon-jsonschema/src/main/java/org/apache/johnzon/jsonschema/spi/builtin/PatternValidation.java"}},{"digest":{"line_hashes":["14960288908314539708249757821313598890","41319175272346572228515860379119629988","324435612962865247101228966114928420207","211500768446711017226937439758428513890"],"threshold":0.9},"id":"CVE-2026-71253-c2877cfe","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/dd3d00634c746a2173a2518e882e85e8a151bf30","target":{"file":"johnzon-jsonschema/src/main/java/org/apache/johnzon/jsonschema/spi/builtin/ExclusiveMinimumValidation.java"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/apache/johnzon/commit/dd3d00634c746a2173a2518e882e85e8a151bf30","target":{"file":"johnzon-mapper/src/main/java/org/apache/johnzon/mapper/map/LazyConverterMap.java"},"deprecated":false,"digest":{"line_hashes":["153267135279514526700775233292565524242","312621287230433282992157876674203821286","256364118624723123277023081722744173207","158309319488319488693879307623139830023","219603854389865276124214816743123500304","179762343716793901022768167935115503546","37265362574154855284813380318300775531","275062135583920706547409889575133320584","113232268110025199647048172372831891252","215611419079362203594267104037860152258","98988308983601015577622526207072635956","163294751233826241252325685211672788500","1339244148027085622432461033181393427","146760659823226683953896892366612683139"],"threshold":0.9},"id":"CVE-2026-71253-cc07aee9","signature_type":"Line"},{"digest":{"function_hash":"206772335040452155387002534330737104709","length":1317},"id":"CVE-2026-71253-cea7f901","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/dd3d00634c746a2173a2518e882e85e8a151bf30","target":{"file":"johnzon-jsonschema/src/main/java/org/apache/johnzon/jsonschema/JsonSchemaValidatorFactory.java","function":"buildAdditionalPropertiesValidations"},"deprecated":false},{"target":{"file":"johnzon-mapper/src/main/java/org/apache/johnzon/mapper/converter/ClassConverter.java","function":"fromString"},"deprecated":false,"digest":{"function_hash":"126541905795718709278600376598300209785","length":202},"id":"CVE-2026-71253-d3c44559","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/dd3d00634c746a2173a2518e882e85e8a151bf30"},{"signature_version":"v1","source":"https://github.com/apache/johnzon/commit/91e7b0d21d08d138944e2570691939739422a3d6","target":{"file":"johnzon-jsonschema/src/main/java/org/apache/johnzon/jsonschema/spi/builtin/PatternValidation.java","function":"create"},"deprecated":false,"digest":{"function_hash":"251648854829649108504044282181086702977","length":489},"id":"CVE-2026-71253-dc541d3a","signature_type":"Function"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["242729590866218701774470340298340847432","39279070899869083432392543580714551560","266724945676322546951393089602356695283","149047096426852709621051493633785210371"]},"id":"CVE-2026-71253-e42bd2d4","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/91e7b0d21d08d138944e2570691939739422a3d6","target":{"file":"johnzon-jsonschema/src/main/java/org/apache/johnzon/jsonschema/spi/builtin/MaxLengthValidation.java"}},{"id":"CVE-2026-71253-f4388afa","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/dd3d00634c746a2173a2518e882e85e8a151bf30","target":{"file":"johnzon-jsonschema/src/main/java/org/apache/johnzon/jsonschema/spi/builtin/ExclusiveMaximumValidation.java"},"deprecated":false,"digest":{"line_hashes":["301494994482083259649722369351888474850","209685955501262137006709966698793381364","327740754429922669158434608552526206479","14742639887824477379136248685891817560"],"threshold":0.9}},{"target":{"function":"create","file":"johnzon-jsonschema/src/main/java/org/apache/johnzon/jsonschema/spi/builtin/MinimumValidation.java"},"deprecated":false,"digest":{"length":441,"function_hash":"199626362406657853927322438374336637237"},"id":"CVE-2026-71253-f4b13db2","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/91e7b0d21d08d138944e2570691939739422a3d6"},{"digest":{"line_hashes":["47411975141698849249545666590449677596","62470577721717107480235219650389604400","134231337077490442479568020461225459517","93601544045610884627235196239027916634","146867621354344760835711855944612581280","243737491883838054122069837376836685567"],"threshold":0.9},"id":"CVE-2026-71253-f69e743d","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/johnzon/commit/91e7b0d21d08d138944e2570691939739422a3d6","target":{"file":"johnzon-jsonschema/src/test/java/org/apache/johnzon/jsonschema/JsonSchemaValidatorTest.java"},"deprecated":false}],"vanir_signatures_modified":"2026-10-21T13:01:51Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71253.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}