Apache Juneau CVE-2026-73095

The target REST resource must use MsgPackParser, which is included by default via the REST server's BasicUniversalConfig, so default Apache Juneau REST resources through 9.2.0 are exploitable without authentication; the attacker sends a MessagePack request whose binary/string length field is large while the actual body is tiny. No special non-default configuration is required for the core MessagePack vector. Limiting factors: only versions through 9.2.0 are affected; the resource must accept/route MessagePack input to MsgPackParser (default but removable); and a request-size limit placed in front of the application reduces (but does not eliminate) exposure since the length field, not the body size, drives the allocation. The related fixes (multipart uploads not bound by maxInput, reader buffer sized from Content-Length, maxInput default lowered from 100 MB to 1 MB) indicate adjacent allocation sinks addressed in the same release.

Signals are sparse and must be weighed accordingly. The Apache advisory (oss-security) rates this 'important' and describes an unauthenticated, remotely reachable denial-of-service: the MessagePack parser sizes a buffer directly from an attacker-controlled length field before reading any payload, so a few-byte request can force a multi-gigabyte allocation and an OutOfMemoryError. Because MsgPackParser is one of the default parsers in the REST server's BasicUniversalConfig, default REST resources are exposed to unauthenticated clients, which raises real-world concern. However, no CVSS vector, EPSS score, KEV listing, or PoC is present in the input, and vuln.today's Decision label is 'awaiting_data' - so quantitative exploitation-probability signals are simply missing rather than low. There is no confidentiality or integrity impact: this is purely availability loss. Net assessment: a credible, easy-to-trigger DoS against default configurations that warrants prompt patching for internet-facing Juneau REST services, but with no confirmed active exploitation and no public exploit code at this time, prioritization should reflect availability-only impact and the product's limited deployment footprint. Authentication is not confirmed from a CVSS vector, but the advisory text explicitly states an unauthenticated client can trigger it against default resources.

An attacker sends a small MessagePack-encoded request body to a default Apache Juneau REST endpoint, where a binary or string length field is set to a very large value. MsgPackParser pre-allocates a buffer of that size before reading the (nonexistent) payload, exhausting the JVM heap and causing an OutOfMemoryError that degrades or crashes the service. No public exploit identified at time of analysis; the attack requires only the ability to send an HTTP request to a resource using the default parser set.