Apache Juneau
CVE-2026-73098
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Apache Juneau ≤9.2.0 instance
-
ExploitInteract with affected module
-
ExecutionTrigger not described in available sources
-
ImpactImpact undetermined from provided data
Vulnerability Assessment
| Exploitation Conditions | Not determinable from the available sources: the provided advisory does not contain a description for CVE-2026-73098, so no specific product feature, protocol, configuration setting, authentication level or deployment mode can be named as a prerequisite. The only established fact is that the flaw resides in Apache Juneau at or below version 9.2.0 and is removed in 9.2.1. The full ASF advisory or the CVE record must be consulted to establish the exact exploitation conditions. |
| Impact | Risk for CVE-2026-73098 specifically cannot be assessed from the supplied data: no CVSS vector, no EPSS score, no CISA KEV entry, and no PoC reference are present, and the vuln.today Decision label is 'awaiting_data'. Critically, although the oss-security advisory covers the Apache Juneau 9.2.1 release that fixes a block of CVEs cited as 'CVE-2026-73095, ..., CVE-2026-73117', CVE-2026-73098 is NOT individually described in the provided text - the only entries detailed are CVE-2026-73095 (parser/REST DoS, important), CVE-2026-73099 (CSRF via content param, important), CVE-2026-121489 (DirectoryResource path traversal, moderate) and CVE-2026-96677 (HTML-doc XSS, moderate). Because the specific mechanism, affected module, severity and CVSS of 73098 are absent, any severity statement would be unsupported. What IS confirmed is that the issue affects Apache Juneau through 9.2.0 and is fixed in 9.2.1. Treat this as a genuinely under-specified record: the mechanism and real-world exploitability of 73098 are not determinable from the available sources and must be verified against the full ASF advisory or the CVE record before prioritization. |
| Exploit ScenarioDerived | No exploit scenario can be responsibly constructed: the provided advisory bundles several Apache Juneau fixes but does not describe CVE-2026-73098 individually, so its attack surface, preconditions and impact are unknown from these sources. No public exploit or PoC reference is present in the input. The only certainty is that affected code paths exist in Apache Juneau through 9.2.0 and are remediated in 9.2.1. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Apache Juneau through 9.2.0 is affected by CVE-2026-73098, one of a batch of vulnerabilities resolved in the 9.2.1 release published on 2026-11-03, but the advisory text supplied here does not include a description for this specific identifier, so the vulnerable feature, attack vector and impact cannot be stated. No CVSS vector, EPSS score, CISA KEV entry or public PoC reference is available, and the vuln.today decision label is awaiting_data; exploitation status is therefore no public exploit identified at time of analysis, which reflects absence of data rather than confirmation that none exists. Affected artifacts include the juneau-* modules and the shaded aggregate artifacts that embed them, all of which must be upgraded to 9.2.1.
RemediationAI
Vendor-released patch: Apache Juneau 9.2.1, published 2026-11-03, which the advisory states fixes the issues in this batch including CVE-2026-73098. Upgrade all org.apache.juneau modules, and every juneau-shaded-* or other aggregate artifact that embeds them, to 9.2.1 from https://downloads.apache.org/juneau/9.2.1/ or via Maven; refer to https://seclists.org/oss-sec/2026/q4/482 and https://juneau.apache.org/security for the vendor statements. Because the supplied advisory contains no description for CVE-2026-73098, no issue-specific workaround can be named; the mitigations documented for its siblings are not confirmed to apply to this identifier. Be aware of the default changes that accompany 9.2.1 and plan for them during the upgrade: request bodies larger than 1 MB now require a larger @Rest(maxInput) setting, error responses no longer carry internal exception detail unless renderResponseStackTraces is enabled, and the content query parameter is honored only on PUT and POST. Applications that do not use the content parameter should additionally set disableContentParam to true, and operators unable to upgrade should consult the ASF advisory and the CVE record directly to establish what exposure, if any, applies to their configuration.
Affected ProductsAI
Apache Juneau through 9.2.0, including the Maven artifacts org.apache.juneau:juneau-marshall, juneau-rest-server, juneau-microservice-core and juneau-commons, as well as the juneau-shaded-* and other aggregate artifacts that embed the affected modules and are affected in the same way. No CPE identifiers are supplied in the available data. The fixed release is Apache Juneau 9.2.1 (Maven org.apache.juneau version 9.2.1), available from https://downloads.apache.org/juneau/9.2.1/; see the oss-security posting at https://seclists.org/oss-sec/2026/q4/482 and the project security page at https://juneau.apache.org/security. Deployments on 9.2.0 or earlier should be inventoried by dependency scan of the org.apache.juneau group, including transitive pulls through shaded artifacts.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Juneau is an Apache Java toolkit providing serializers and parsers (juneau-marshall), a REST server layer (juneau-rest-server), microservice support including DirectoryResource (juneau-microservice-core) and shared utilities (juneau-commons). The same 9.2.1 release announcement documents sibling issues in these layers: unbounded memory allocation in the MessagePack parser and REST request handling (CVE-2026-73095), path traversal in microservice DirectoryResource (CVE-2026-121489), cross-site scripting through unescaped Simple Variable Language request variables in HTML-doc chrome (CVE-2026-96677), and CSRF via the default-enabled content query-parameter body override (CVE-2026-73099). No CWE is assigned in the supplied data for CVE-2026-73098 and the advisory excerpt contains no entry for it, so its root-cause class is unknown; the fact that it shares a release and remediation path with the listed issues does not establish that it belongs to any of those classes.
Know when Java gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Description PRE-NVD
Threat Intelligence Overview
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
GitHub PoC
Exploit-DB