Threats affecting pkg:maven/org.apache.juneau/juneau-rest-server.

Apache Juneau versions prior to 9.2.1 have a vulnerability where error responses expose internal exception class names and messages to remote clients. This occurs through the 'Thrown' response header and may also include internal exception messages in the error body, even if stack-trace rendering is disabled. This information disclosure reveals implementation details that could aid attackers. The issue is fixed in version 9.2.1.

CVE-2026-73099 is a critical Cross-Site Request Forgery (CSRF) vulnerability in Apache Juneau affecting versions prior to 9.2.1. The REST server accepts a "content" query parameter that replaces the request body on all HTTP methods, including GET, enabling attackers to craft cross-site requests that bypass CORS preflight checks and protections relying on HTTP method or content type. The issue is fixed in Apache Juneau version 9.2.1. Users can also mitigate by disabling the content parameter if unused.