CVE-2026-121489

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Juneau. The microservice DirectoryResource does not keep request paths inside its configured root directory. When an application enables the resource's view, upload or delete settings all off by...

CVE-2026-96677

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Juneau. HTML document serialization does not HTML-encode variable substitutions in the page chrome header, nav, aside, footer and similar fields. Applications whose chrome includes...

CVE-2026-73117

Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Response Splitting' vulnerability in Apache Juneau. The Apache Juneau REST server passed response header values and redirect targets to the servlet container unchecked. An application that sets a response header or redirect target fr...

CVE-2026-73116

Insufficiently Protected Credentials vulnerability in Apache Juneau. The Apache Juneau RestClient followed HTTP redirects while keeping credential headers from the original request, so a server that redirected the client to a different host or port, or from HTTPS to HTTP, could receive headers su...

CVE-2026-73101

Generation of Error Message Containing Sensitive Information vulnerability in Apache Juneau. The REST server sends the internal exception class and message to clients in a "Thrown" response header on every error response, and can include internal exception messages in the error body, even when...

CVE-2026-73100

Insertion of Sensitive Information into Log File vulnerability in Apache Juneau. The default REST server call logger records request headers for requests that end in a server error, without redacting them. Any client able to cause a server error gets headers such as Authorization, Cookie,...

CVE-2026-73099

Cross-Site Request Forgery CSRF vulnerability in Apache Juneau. The REST server accepts a "content" query parameter that replaces the request body, and this is enabled by default on every HTTP method, including GET. A cross-site link can therefore deliver an attacker-chosen request body to an...

CVE-2026-73098

Improper control of dynamically-loaded code vulnerability in Apache Juneau. When Apache Juneau parses a value into a property of type java.lang.Class including parameterized forms, the default class swap loaded the named class with initialization enabled, so input naming a class on the applicatio...

CVE-2026-73095

Allocation of Resources Without Limits or Throttling vulnerability in Apache Juneau. The MessagePack parser, which the REST server enables by default, sizes buffers from length values in the input. An unauthenticated client can send a few bytes that force a multi-gigabyte allocation and an...