Apache Juneau
CVE-2026-73117
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach an Apache Juneau 9.2.0-or-earlier component
-
ExploitTrigger the undisclosed flaw (mechanism not described in available sources)
-
ImpactResulting impact not specified in available sources
Vulnerability Assessment
| Exploitation Conditions | The exploitation prerequisites for CVE-2026-73117 cannot be stated because this CVE is not individually described in the advisory - the text details only CVE-2026-73095, CVE-2026-121489, CVE-2026-96677, and CVE-2026-73099. The only confirmed constraint is that the affected code runs in Apache Juneau at or below version 9.2.0 (org.apache.juneau modules, including juneau-shaded aggregate artifacts); the required feature, configuration mode, authentication level, and whether user interaction is needed are all undisclosed in the available sources and must be obtained from the official CVE record. |
| Impact | Real-world risk cannot be meaningfully assessed for CVE-2026-73117 from the supplied data because this specific CVE is NOT individually described anywhere in the advisory - it appears only inside the subject line's enumeration '(CVE-2026-73095, ..., CVE-2026-73117)', where the '...' indicates omitted intermediate CVEs. The four vulnerabilities actually detailed in the body are CVE-2026-73095 (DoS/unbounded allocation), CVE-2026-121489 (path traversal), CVE-2026-96677 (XSS), and CVE-2026-73099 (CSRF); none of these is CVE-2026-73117, so its severity, mechanism, and impact are undisclosed here. No CVSS vector is provided (NVD/vendor show N/A), no EPSS score, no KEV listing, and no PoC or exploit reference is present, and the vuln.today Decision label is explicitly 'awaiting_data'. With every quantitative signal absent and no per-CVE description, there is no basis to call this a priority or to downgrade it - the only confirmed facts are that it is one of the issues fixed in Apache Juneau 9.2.1 (released 2026-11-03) and that it affects Apache Juneau through 9.2.0. These gaps must be resolved against the official CVE record before triage; treat current status as indeterminate, not low-risk. |
| Exploit ScenarioDerived | No exploit scenario can be constructed because the trigger, affected component, and impact of CVE-2026-73117 are not described in the available sources - it is referenced only by ID in the advisory subject line. No PoC or exploit reference is present in the input. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Apache Juneau through 9.2.0 is named in an aggregated November 2026 advisory for CVE-2026-73117, but the supplied sources do not describe this CVE's vulnerability class, affected module, exploitation prerequisites or impact; only the shared fixed version is confirmed. The advisory's individual write-ups cover CVE-2026-73095, CVE-2026-121489, CVE-2026-96677 and CVE-2026-73099, not this CVE. No public exploit or CISA KEV entry is identified in the supplied data, and impact remains unassessed until the official CVE record is available.
RemediationAI
Vendor-released patch: Apache Juneau 9.2.1 (Maven org.apache.juneau version 9.2.1), released 2026-11-03; upgrade Juneau and all juneau-shaded-* or other aggregate artifacts to 9.2.1. Because the supplied advisory does not describe CVE-2026-73117's trigger, no issue-specific workaround can be recommended from this data; the mitigations listed for other CVE IDs, such as removing MsgPackParser, disabling DirectoryResource allowViews/allowUploads/allowDeletes, removing RQ/RH/RF/RP from HtmlDocConfig chrome fields, or setting disableContentParam=true, are attributed to those other issues. Expect 9.2.1 behavior changes: request bodies over 1 MB require a larger @Rest(maxInput), error responses omit internal exception detail unless renderResponseStackTraces is enabled, and the content query parameter is honored only on PUT and POST. See https://seclists.org/oss-sec/2026/q4/482 and https://downloads.apache.org/juneau/9.2.1/.
Affected ProductsAI
Apache Juneau through 9.2.0 is the confirmed affected product line for the aggregated advisory, with Maven artifacts under the org.apache.juneau group; juneau-shaded-* and other aggregate artifacts that embed affected modules are also affected. The advisory does not identify which specific module applies to CVE-2026-73117, only that all listed issues affect versions through 9.2.0 and that version 9.2.1 is the fixed release. References include the oss-security advisory at https://seclists.org/oss-sec/2026/q4/482, the 9.2.1 download directory at https://downloads.apache.org/juneau/9.2.1/, and the project security page at https://juneau.apache.org/security.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The advisory is a coordinated Apache Juneau 9.2.1 release note covering multiple CVEs across org.apache.juneau modules. For CVE-2026-73117, no CWE, CVSS vector, root cause, parser/serializer/REST component, trigger or deployment prerequisite is supplied; the CVE appears only in the subject line's enumerated list. The only confirmed technical boundary is the affected codebase: Apache Juneau through 9.2.0, including juneau-shaded and other aggregate artifacts that embed affected modules. The separately described issues involve MessagePack parser allocation, DirectoryResource path traversal, HtmlDocConfig chrome XSS and a content query-parameter CSRF override, but none of those descriptions is attributed to CVE-2026-73117 in the supplied evidence.
Know when Java gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Description PRE-NVD
Threat Intelligence Overview
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
GitHub PoC
Exploit-DB