{"id":"CVE-2026-73098","published":"2026-11-05T12:17:50.770","lastModified":"2026-11-05T19:17:26.667","description":"Improper control of dynamically-loaded code vulnerability in Apache Juneau.\n\nWhen Apache Juneau parses a value into a property of type java.lang.Class (including parameterized forms), the default class swap loaded the named class with initialization enabled, so input naming a class on the application classpath ran that class's static initializer. The impact depends on the classes present in the deployment.\n\nThis issue affects Apache Juneau: through 9.2.0.\n\nUsers are recommended to upgrade to version 9.2.1, which fixes the issue.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-470"],"vendors":[],"products":[],"references":[{"url":"https://lists.apache.org/thread.html/j05q7vw08j48o96tdlzcsd4sozx1lyl6","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}