CVE-2026-73098

{
  "etk_id": "ETK-2026-3626",
  "cve_id": "CVE-2026-73098",
  "display_id": "CVE-2026-73098",
  "ghsa_id": "GHSA-59fg-f5xc-xjg9",
  "euvd_id": "EUVD-2026-117407",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unsafe class loading in Apache Juneau",
  "summary": "Apache Juneau through 9.2.0 can initialize classes from the application classpath while processing input assigned to java.lang.Class properties. An attacker may trigger static initialization of an available class if they can control data that the application parses into such a property.",
  "mitigation": "Upgrade Apache Juneau to version 9.2.1 or later. Until upgraded, prevent untrusted input from being parsed into java.lang.Class properties.",
  "vendor": "Apache Software Foundation",
  "product": "Apache Juneau",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 9.2.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "9.2.1"
      ],
      "package_name": "org.apache.juneau:juneau-marshall",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 10,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 12.95872065,
  "t0_at": "2026-11-05T11:49:18.771000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-05T11:49:18.771000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-05T11:49:18.771000+00:00",
      "url": "https://github.com/advisories/GHSA-59fg-f5xc-xjg9"
    }
  }
}