Apache Juneau
CVE-2026-73101
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttack chain cannot be grounded - CVE-2026-73101 is not individually described in the available data (no CVSS vector, no affected-module detail), so no kill-chain steps can be derived from actual CVE data.
Vulnerability Assessment
| Exploitation Conditions | Exploitation conditions cannot be stated: CVE-2026-73101 is not individually described in the supplied advisory, so no product feature, protocol, configuration setting, deployment mode, authentication level, or user-interaction requirement is known for this identifier. The generic remediation for the release (upgrade org.apache.juneau artifacts, including juneau-shaded aggregates, to 9.2.1) applies, but the specific precondition for this CVE is undetermined. |
| Impact | No specific risk signals are available for CVE-2026-73101. The supplied oss-security advisory announces the Apache Juneau 9.2.1 release and states it fixes a range of issues (CVE-2026-73095 through CVE-2026-73117), but the only individually documented entries are CVE-2026-73095 (DoS via unbounded allocation), CVE-2026-121489 (DirectoryResource path traversal), CVE-2026-96677 (XSS in HTML-doc chrome), and CVE-2026-73099 (CSRF via content query parameter) - none of which is CVE-2026-73101. For CVE-2026-73101 specifically: CVSS vector is N/A, so attack vector, complexity, privileges, and impact cannot be assessed; no EPSS score, no CISA KEV listing, and no PoC reference are provided; the vuln.today decision label is 'awaiting_data'. Because the requested CVE falls numerically inside the advisory's stated range but has no dedicated description, its mechanism, affected module, and severity cannot be determined from the available sources. This should be treated as an unscored, undescribed identifier pending per-CVE detail from the Apache Juneau PMC or NVD, not as a confirmed high-risk item. |
| Exploit ScenarioDerived | No exploit scenario can be constructed for CVE-2026-73101 because the trigger, affected component, and attack vector for this specific identifier are not described in the available sources. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Apache Juneau 9.2.1, published 2026-11-03, closes a batch of security defects in the Java marshalling and REST framework that affect every release through 9.2.0, and CVE-2026-73101 is one of the identifiers covered by that release advisory. The published text does not give CVE-2026-73101 its own description, so the affected feature, trigger and preconditions for this specific identifier remain undetermined; the concrete issues that are described in the same advisory span parser memory exhaustion, path traversal in DirectoryResource, HTML-doc cross-site scripting and a content query-parameter body override. Anyone running org.apache.juneau artifacts, including the juneau-shaded-* and other aggregate artifacts that embed the affected modules, should treat exposure as unresolved until they move to 9.2.1; no public exploit code and no confirmed active exploitation are associated with this identifier in the available data, and the priority signal is awaiting_data with no EPSS, KEV or CVSS scoring supplied.
RemediationAI
Upgrade to the vendor-released Apache Juneau 9.2.1: use Maven coordinate org.apache.juneau version 9.2.1, or the binary and source archives published at https://downloads.apache.org/juneau/9.2.1/ (apache-juneau-9.2.1-bin.zip and apache-juneau-9.2.1-src.zip, dated 2026-11-03), and upgrade the juneau-shaded-* and any other aggregate artifacts to 9.2.1 in the same pass since they embed the affected modules. Be aware that the upgrade changes defaults: request bodies over 1 MB now require a larger @Rest(maxInput) (the default maxInput dropped from 100 MB to 1 MB), error responses no longer carry internal exception detail unless renderResponseStackTraces is enabled, and the content query parameter is honored only on PUT and POST, so test endpoints that depend on the previous behaviour. For the issues that the advisory describes individually, the documented interim mitigations are: on releases that cannot be upgraded, remove MsgPackParser from resources accepting untrusted input, with a front-end request size limit noted as reducing but not removing the exposure; disable allowViews, allowUploads and allowDeletes on DirectoryResource or avoid exposing it to untrusted clients; remove the RQ, RH, RF and RP request variables from HtmlDocConfig chrome fields; and set disableContentParam to true in applications that do not use the content parameter. Those workarounds are stated for those specific sibling issues and are not confirmed to address CVE-2026-73101, whose own preconditions are undetermined, so upgrading to 9.2.1 is the complete fix identified in the available data.
Affected ProductsAI
Apache Juneau through 9.2.0 is affected, fixed in 9.2.1 per the oss-security advisory. The advisory names the Maven modules org.apache.juneau:juneau-marshall, org.apache.juneau:juneau-rest-server, org.apache.juneau:juneau-microservice-core and org.apache.juneau:juneau-commons as the carriers of the individually described issues, and states that the juneau-shaded-* and other aggregate artifacts embed the affected modules and are affected in the same way, so they must be upgraded to 9.2.1 as well. No CPE identifiers or formal version ranges beyond "through 9.2.0" are supplied in the data. Vendor material is at https://seclists.org/oss-sec/2026/q4/482 and https://juneau.apache.org/security, with the 9.2.1 distribution at https://downloads.apache.org/juneau/9.2.1/.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Juneau is an Apache Software Foundation Java toolkit that combines a marshalling layer (parsers and serializers for JSON, XML, HTML, MessagePack, URL-encoded and other formats, distributed as juneau-marshall) with a REST server and client stack (juneau-rest-server), a microservice core with built-in resources such as DirectoryResource (juneau-microservice-core), shared utilities (juneau-commons), and a Simple Variable Language templating layer used for HTML document rendering. Release 9.2.1 is a coordinated security release, and the advisory notes that the shaded and aggregate artifacts bundle the affected modules and inherit the same exposure, so version pinning at the aggregate level matters as much as at the module level. No CWE identifier is assigned in the supplied data (CWE listed as N/A) and no CVSS vector is provided, so the root-cause class for CVE-2026-73101 specifically cannot be stated. For context only, the sibling issues described in the same advisory cover an unbounded allocation in the MessagePack parser sized from a length field before any payload is read (reachable through the REST server's default BasicUniversalConfig), a traversal flaw where DirectoryResource built paths from the request path without confining them to the configured root, missing HTML encoding of SVL substitutions in HTML-doc chrome regions with raw request variables RQ/RH/RF/RP, and a default-enabled content query parameter that replaced request bodies on all HTTP methods. None of those mechanisms is confirmed to be the subject of CVE-2026-73101, and the trigger for this identifier is not described in the available sources.
Know when Java gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Description PRE-NVD
Articles & Coverage 1
Executive ViewAI
Apache Juneau, a widely used Java framework for REST and marshalling, has a high-severity vulnerability (CVE-2026-73101) affecting all versions through 9.2.0. Although the exact technical details for this specific CVE are not yet publicly defined, the vendor's advisory for the release that fixes it (9.2.1) also addresses critical issues like parser memory exhaustion, path traversal, cross-site scripting, and request body manipulation. Organizations using Juneau or its shaded artifacts face potential service disruptions, data exposure, or system compromise until they upgrade, making this a priority for security and development leadership.
No vendor-released patch identified at time of analysis
Threat Intelligence Overview
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
GitHub PoC
Exploit-DB