Apache Juneau
CVE-2026-73100
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCVE-2026-73100 not individually described
-
Exploitmechanism and attack vector unknown
-
Executionconsult per-CVE vendor/NVD entry
-
Impactrisk impact undetermined
Vulnerability Assessment
| Exploitation Conditions | Exploitation conditions for CVE-2026-73100 are not stated in any available source - the specific product feature, protocol, configuration setting or deployment mode required is undescribed because this CVE is not individually documented in the supplied advisory. The only established facts are that it affects Apache Juneau through version 9.2.0 and is fixed in 9.2.1; whether it requires a non-default setting (as the sibling path-traversal issue does), authentication, or user interaction is unverified. Per the vendor, upgrading to 9.2.1 is the remediation. |
| Impact | Real-world risk for CVE-2026-73100 CANNOT be assessed from the supplied data because this specific CVE is not individually described anywhere in the input. The oss-security advisory covers the Apache Juneau 9.2.1 release and explicitly details only four CVEs (CVE-2026-73095, CVE-2026-121489, CVE-2026-96677, CVE-2026-73099); the advisory subject line references a range 'CVE-2026-73095, ..., CVE-2026-73117', and CVE-2026-73100 falls inside that range but has no dedicated description, severity rating, affected-module list, or mitigation text here. No CVSS vector or score is provided (NVD and the linked Juneau security page both show N/A), no EPSS probability is supplied, KEV status is not listed (no CISA KEV entry indicated), and no PoC/exploit reference is present. The vuln.today Decision label is 'awaiting_data', which is consistent with this gap and means no priority signal is available. The only confirmed facts are contextual: the vulnerability is part of the Apache Juneau batch fixed in 9.2.1 (released 2026-11-03) and therefore affects Apache Juneau through 9.2.0. Because mechanism, attack vector, privilege requirement and impact are all undescribed, this cannot currently be classified as either a genuine priority or a low-real-risk item - it is simply under-documented and must be verified against the per-CVE entry once the vendor/NVD publishes it. |
| Exploit ScenarioDerived | No realistic exploit scenario can be constructed: CVE-2026-73100 is not individually described in any provided source, so the vulnerable component, trigger and impact are unknown. The trigger is not described in the available sources. No public exploit or PoC reference is present for this CVE. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Apache Juneau through 9.2.0 is affected by CVE-2026-73100, one of a batch of vulnerabilities resolved together in the 9.2.1 release dated 2026-11-03. The supplied vendor advisory lists the CVE identifier in its title but does not describe the flaw's mechanism, the module it lives in, or the configuration and access preconditions it requires, so impact, attack vector and severity remain unconfirmed from available data. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS or CVSS scoring is available.
RemediationAI
Vendor-released patch: Apache Juneau 9.2.1 (released 2026-11-03), which the vendor states fixes CVE-2026-73100 together with the rest of the batch. Upgrade every Juneau dependency to org.apache.juneau version 9.2.1 from https://downloads.apache.org/juneau/9.2.1/, including juneau-shaded-* and other aggregate artifacts that embed the affected modules, and verify the .asc/.sha512 files published alongside the distribution. Because the advisory does not describe this CVE's trigger, no CVE-specific workaround can be prescribed; the vendor's stated mitigation is to upgrade, and no per-issue compensating control is given for this identifier. Plan for the behavioral changes that accompany 9.2.1: the default maxInput drops from 100 MB to 1 MB, so endpoints accepting request bodies over 1 MB need an explicit larger @Rest(maxInput); error responses no longer include internal exception detail unless renderResponseStackTraces is enabled, which may affect debugging workflows; and the content query parameter is now honored only on PUT and POST, so any client relying on content-based body override with GET or other methods must be changed. Applications that do not use the content parameter can additionally set disableContentParam to true. Consult https://juneau.apache.org/security and the oss-security announcement at https://seclists.org/oss-sec/2026/q4/482 for the current vendor guidance.
Affected ProductsAI
All Apache Juneau releases through 9.2.0 are affected, including the Maven artifacts org.apache.juneau:juneau-marshall, org.apache.juneau:juneau-rest-server, org.apache.juneau:juneau-microservice-core and org.apache.juneau:juneau-commons, and by extension the juneau-shaded-* and other aggregate artifacts that embed those modules, which the vendor states are affected in the same way and must be upgraded as well. The vendor advisory does not break out which specific module or version range applies to CVE-2026-73100 individually; only the framework-wide statement that all issues in the batch affect Juneau through 9.2.0 and are fixed in 9.2.1. No CPE identifiers were provided in the input. Fixed artifacts are published under org.apache.juneau version 9.2.1 and from https://downloads.apache.org/juneau/9.2.1/ (apache-juneau-9.2.1-bin.zip, apache-juneau-9.2.1-src.zip). Advisory references: https://seclists.org/oss-sec/2026/q4/482 and https://juneau.apache.org/security.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Juneau is a Java toolkit for marshalling (serializers and parsers for JSON, XML, HTML, MessagePack, URL-encoded and other formats) plus a REST server layer and microservice framework, published as Maven artifacts under org.apache.juneau (juneau-marshall, juneau-rest-server, juneau-microservice-core, juneau-commons) with shaded aggregate artifacts that embed those modules. CVE-2026-73100 is disclosed only as a title entry in a bundled oss-security announcement covering a large set of Juneau CVEs (CVE-2026-73095 through CVE-2026-73117); no CWE classification, CVSS vector or per-issue technical description accompanies it in the supplied sources, so the root-cause class and the specific code path involved cannot be stated. The announcement's individually described siblings do illustrate the framework's general exposure surface - unbounded allocation when parsing attacker-supplied length fields, path handling in DirectoryResource, unencoded variable substitution in HTML-doc chrome, and a default-enabled content query parameter that overrides request bodies - but none of those write-ups are attributed to CVE-2026-73100 and should not be treated as describing it. Consumers should assume the affected code is reachable wherever the corresponding juneau-marshall, juneau-rest-server, juneau-microservice-core or juneau-commons module (or a shaded aggregate embedding them) is deployed from an untrusted input path.
Know when Java gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Description PRE-NVD
Threat Intelligence Overview
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
GitHub PoC
Exploit-DB