Apache Juneau
CVE-2026-73116
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Apache Juneau ≤9.2.0 deployment
-
ExploitVulnerability details for CVE-2026-73116 absent from sources
-
ImpactTrigger and impact undetermined
Vulnerability Assessment
| Exploitation Conditions | The exploitation prerequisites for CVE-2026-73116 are not stated in the available sources; the advisory provided describes four unrelated Apache Juneau CVEs and does not name the component, feature, or configuration tied to this identifier. The only confirmed scoping condition is that the product must be Apache Juneau at or below version 9.2.0 (fixed in 9.2.1, including juneau-shaded and aggregate artifacts). Any feature-, SAPI-, or configuration-specific limiting factors cannot be determined until the vendor or NVD record for CVE-2026-73116 is obtained. |
| Impact | Risk cannot be responsibly quantified for CVE-2026-73116 because the specific vulnerability is not described in any of the supplied sources. The oss-security advisory header references a bundled CVE range (CVE-2026-73095 through CVE-2026-73117) for Apache Juneau 9.2.1, but the advisory body individually details only four distinct issues - CVE-2026-73095 (DoS via unbounded allocation), CVE-2026-121489 (path traversal), CVE-2026-96677 (XSS), and CVE-2026-73099 (CSRF via content param) - and none of these is CVE-2026-73116. No CVSS vector, EPSS score, KEV listing, or PoC reference is provided for this identifier, and the vuln.today decision label is 'awaiting_data', which is consistent with an incomplete record. Because attack vector, complexity, privilege, and impact are all unknown, there is no basis to call this a priority or to dismiss it as low-risk; it is simply unassessed. The only confirmed fact that applies is that all issues in this advisory affect Apache Juneau through 9.2.0 and are fixed in 9.2.1 - verify the exact nature of CVE-2026-73116 against the Apache Juneau PMC advisory or NVD before acting. |
| Exploit ScenarioDerived | No attack scenario can be constructed because the trigger, affected component, and impact of CVE-2026-73116 are not described in the available sources. The supplied advisory text documents four other Apache Juneau 9.2.x CVEs but does not characterize this specific identifier. No public exploit or PoC reference is present for CVE-2026-73116. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
CVE-2026-73116 is an Apache Juneau security identifier for which the supplied oss-security advisory provides no component, mechanism, or impact detail; the advisory states that all issues it lists affect Juneau through 9.2.0 and are fixed in 9.2.1, including juneau-shaded-* and other aggregate artifacts. Deployments using affected Juneau versions should treat the identifier as uncharacterized until the vendor or NVD record supplies specifics. No public exploit code or CISA KEV entry was identified at time of analysis.
RemediationAI
Upgrade to Apache Juneau 9.2.1, available from https://downloads.apache.org/juneau/9.2.1/ and as Maven org.apache.juneau version 9.2.1; update juneau-shaded-* and any other aggregate artifacts to 9.2.1 as well because they embed the affected modules. The advisory notes behavior changes in 9.2.1: request bodies over 1 MB require a larger @Rest(maxInput), error responses no longer include internal exception detail unless renderResponseStackTraces is enabled, and the content query parameter is honored only on PUT and POST. Because the supplied sources do not describe the component or mechanism of CVE-2026-73116, no vulnerability-specific workaround can be derived; the vendor-stated remediation for the 9.2.1 set is upgrading, with the oss-security advisory at https://seclists.org/oss-sec/2026/q4/482 and the vendor security page at https://juneau.apache.org/security as references.
Affected ProductsAI
Apache Juneau through 9.2.0 is the confirmed affected range for the advisory's listed issues, and the advisory states that juneau-shaded-* and other aggregate artifacts embed the affected modules and are affected in the same way. The sibling issues reference modules such as org.apache.juneau:juneau-marshall, juneau-rest-server, juneau-microservice-core, and juneau-commons, but the sources do not identify which module or feature corresponds specifically to CVE-2026-73116. Fixed artifacts are available as Apache Juneau 9.2.1 from https://downloads.apache.org/juneau/9.2.1/ and Maven org.apache.juneau version 9.2.1; the vendor security page is https://juneau.apache.org/security.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Juneau is a Java framework for serialization, parsing, and REST/microservice development. The supplied advisory describes four unrelated Juneau issues - CVE-2026-73095 (MessagePack parser and REST request-handling denial of service), CVE-2026-121489 (DirectoryResource path traversal), CVE-2026-96677 (HTML-doc chrome cross-site scripting), and CVE-2026-73099 (content query-parameter CSRF/body override) - but does not describe CVE-2026-73116. No CWE, CVSS vector, or CPE data is provided for this identifier, so the root-cause class and exact affected module cannot be determined from the available sources. The advisory does confirm that the 9.2.1 release fixes the listed set and that aggregate/shaded artifacts embed affected modules.
Know when Java gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Description PRE-NVD
Threat Intelligence Overview
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
GitHub PoC
Exploit-DB