Advisories · Technology

Apache Software Foundation Apache Juneau.

Every CVE that names Apache Software Foundation Apache Juneau among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-121489 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Apache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directory
- Apache Software Foundation Apache Juneau
- Path traversal
Not analysed yet 5 Nov 2026
CVE-2026-96677 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome
- Apache Software Foundation Apache Juneau
- Cross-site scripting (XSS)
Not analysed yet 5 Nov 2026
CVE-2026-73117 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Apache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request data
- Apache Software Foundation Apache Juneau
- Other injection
Not analysed yet 5 Nov 2026
CVE-2026-73116 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirects
- Apache Software Foundation Apache Juneau
- Hard-coded credentials
Not analysed yet 5 Nov 2026
CVE-2026-73101 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Apache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaults
- Apache Software Foundation Apache Juneau
- Information disclosure
Not analysed yet 5 Nov 2026
CVE-2026-73100 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Apache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errors
- Apache Software Foundation Apache Juneau
- Information disclosure
Not analysed yet 5 Nov 2026
CVE-2026-73099 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body override
- Apache Software Foundation Apache Juneau
- Cross-site request forgery (CSRF)
Not analysed yet 5 Nov 2026
CVE-2026-73098 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during parsing
- Apache Software Foundation Apache Juneau
- Code injection
Not analysed yet 5 Nov 2026
CVE-2026-73095 CVE record

CVSS 8.7 High

Apache Juneau: Denial of service via unbounded memory allocation in parsers and REST request handling
- Apache Software Foundation Apache Juneau
- Denial of service
Not analysed yet 5 Nov 2026