CVE-2026-73098

CVE-2026-73098 is a vulnerability involving the improper control of dynamically-loaded code in Apache Juneau, affecting versions up to and including 9.2.0. The issue arises during REST marshalling when the framework parses values into bean properties of the `java.lang.Class` type, including parameterized forms. Under default configurations, the class swap mechanism loads the specified class with initialization enabled. Because initialization is enabled, an attacker-controlled class name can trigger the execution of that class's static initializer if the class is present on the application's classpath. The exact impact of this behavior depends on the specific classes available within the deployment. To address this issue, users are advised to upgrade to Apache Juneau version 9.2.1, which modifies the loading process to load classes without initializing them.