Threats affecting pkg:maven/org.apache.juneau/juneau-marshall

CVE-2026-96677 is a critical cross-site scripting (XSS) vulnerability in Apache Juneau affecting versions prior to 9.2.1. The issue arises because HTML document serialization does not encode variable substitutions in page chrome elements such as headers and navigation bars. Applications that include request-derived variables in these areas without encoding them are vulnerable to XSS attacks. The default chrome does not use request variables, so only customized applications are affected. The vulnerability is fixed in Apache Juneau version 9.2.1.

CVE-2026-73098 is a critical vulnerability in Apache Juneau through version 9.2.0 involving improper control of dynamically-loaded code. The flaw allows input that names a class on the application classpath to trigger the static initializer of that class during parsing, potentially leading to harmful side effects depending on the classes present. This issue is fixed in version 9.2.1.

CVE-2026-73095 is a high-severity vulnerability in Apache Juneau through version 9.2.0. It involves allocation of resources without limits or throttling in the MessagePack parser enabled by default in the REST server. An unauthenticated client can trigger multi-gigabyte memory allocations causing an OutOfMemoryError and denial of service. Related unbounded allocations in multipart uploads and request reader buffers are also addressed. The issue is fixed in version 9.2.1.