Apache Juneau 9.2.1 fixes multiple vulnerabilities
Apache Juneau 9.2.1, released November 3, addresses multiple CVEs including CVE-2026-73095.
50
CVE-2026-73116
Insufficiently Protected Credentials in Apache Juneau before 9.2.1
- CVSS 4.0
- 10.0 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache Juneau RestClient follows HTTP redirects while keeping original request credential headers. Attackers trigger this by redirecting the client and gain access to headers like Authorization and Cookie. Affects Apache Juneau users through version 9.2.0.
What to do: Upgrade to Apache Juneau 9.2.1. Custom HttpClients require disabling automatic redirects or stripping credential headers.
| Product | Affected | Fixed in |
|---|---|---|
| Apache Juneau | through 9.2.0 | 9.2.1 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Insufficiently Protected Credentials vulnerability in Apache Juneau. The Apache Juneau RestClient followed HTTP redirects while keeping credential headers from the original request, so a server that redirected the client to a different host or port, or from HTTPS to HTTP, could receive headers such as Authorization, Cookie, Proxy-Authorization and X-API-Key. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue. The fix applies to HTTP clients created by the RestClient builder; applications that supply their own HttpClient must disable automatic redirects or strip credential headers on cross-origin redirects themselves.
- Weakness
- CWE-522
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X