CVE-2026-73117 is a critical vulnerability in Apache Juneau through version 9.2.0 involving improper neutralization of CRLF sequences in HTTP headers, also known as HTTP Response Splitting. The issue arises because the REST server passes response header values and redirect targets to the servlet container without sanitization. This can allow remote clients to inject header lines or redirect users to arbitrary external sites if the application sets headers or redirects based on request data. The vulnerability is fixed in version 9.2.1, which sanitizes header values by default and introduces a safer redirect method.