Threats affecting pkg:maven/org.apache.juneau/juneau-rest-server

CVE-2026-73117 is a critical HTTP Response Splitting vulnerability in Apache Juneau through version 9.2.0. The issue arises because response header values and redirect targets passed to the servlet container are not properly sanitized, allowing remote attackers to inject malicious header lines or redirect users to arbitrary external sites. The vulnerability depends on application code that uses request data to set headers or redirects. Apache Juneau version 9.2.1 addresses this by sanitizing header values by default and introducing a safer redirect method.

CVE-2026-73100 is a critical vulnerability in Apache Juneau up to version 9.2.0 where sensitive information such as Authorization headers and API keys are logged in cleartext when a server error occurs. This exposure occurs because the default REST server call logger does not redact sensitive request headers before writing them to application logs. The issue is fixed in version 9.2.1.

CVE-2026-73095 is a high-severity vulnerability in Apache Juneau through version 9.2.0. It involves allocation of resources without limits or throttling in the MessagePack parser enabled by default in the REST server. An unauthenticated client can trigger multi-gigabyte memory allocations causing an OutOfMemoryError and denial of service. Related unbounded allocations in multipart uploads and request reader buffers are also addressed. The issue is fixed in version 9.2.1.