Apache Juneau versions through 9.2.0 have a vulnerability where error messages expose sensitive internal exception details to remote clients. This occurs because the REST server includes the internal exception class and message in a "Thrown" response header and may include exception messages in the error body, even when stack-trace rendering is disabled. This information disclosure reveals implementation details that could aid attackers. The issue is fixed in version 9.2.1.