Apache Juneau 9.2.1 fixes multiple vulnerabilities
Apache Juneau 9.2.1, released November 3, addresses multiple CVEs including CVE-2026-73095.
50
Vulnerability1 · 1 read
CVE-2026-73095
Resource Exhaustion DoS in Apache Juneau MessagePack Parser
- CVSS 4.0
- 8.7 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache Juneau REST server enables MessagePack parser by default. Unauthenticated clients send crafted input to force multi-gigabyte allocations and OOM errors, causing DoS. Related unbounded allocations occur in REST request handling. Affects Apache Juneau through 9.2.0. Fixed in 9.2.1.
What to do: Upgrade to Apache Juneau 9.2.1. No workaround is provided.
| Product | Affected | Fixed in |
|---|---|---|
| Apache Juneau | through 9.2.0 | 9.2.1 |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Allocation of Resources Without Limits or Throttling vulnerability in Apache Juneau. The MessagePack parser, which the REST server enables by default, sizes buffers from length values in the input. An unauthenticated client can send a few bytes that force a multi-gigabyte allocation and an OutOfMemoryError, causing denial of service. Related unbounded allocations in REST request handling (multipart uploads and request reader buffers) are fixed at the same time. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue.
- Weakness
- CWE-770
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
In the news
2 storiesApache Juneau 9.2.1 fixes multiple vulnerabilities
Apache Juneau 9.2.1, released on 2026-11-03, fixes multiple vulnerabilities with upgrade recommended.
40