Apache Juneau 9.2.1 fixes multiple vulnerabilities
Apache Juneau 9.2.1, released November 3, addresses multiple CVEs including CVE-2026-73095.
50
CVE-2026-73117
HTTP Response Splitting in Apache Juneau REST server
- CVSS 4.0
- 10.0 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache Juneau REST server passes response headers and redirect targets from request data unchecked to the servlet container. A remote attacker can trigger this if application code sets headers or redirects from user input, injecting CRLF sequences or forcing arbitrary redirects. This affects any application using Apache Juneau through 9.2.0.
What to do: Upgrade to Apache Juneau 9.2.1. Applications building redirects from request data must switch to sendSafeRedirect().
| Product | Affected | Fixed in |
|---|---|---|
| Apache Juneau | through 9.2.0 | 9.2.1 |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability in Apache Juneau. The Apache Juneau REST server passed response header values and redirect targets to the servlet container unchecked. An application that sets a response header or redirect target from request data could let a remote client inject header lines (where the servlet container does not itself reject CR/LF) or redirect users to an arbitrary external site. The framework itself does not build headers or redirects from request data; exposure depends on application code. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue. Header values are now sanitized by default; applications that build redirect targets from request data must also switch from sendRedirect() to the new sendSafeRedirect().
- Weakness
- CWE-113
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
In the news
2 storiesApache Juneau 9.2.1 fixes multiple vulnerabilities
Apache Juneau 9.2.1, released on 2026-11-03, fixes multiple vulnerabilities with upgrade recommended.
40