---
id: CVE-2026-73101
title: >-
  Apache Juneau: Internal exception class and message disclosed via error
  response header and body regardless of secure defaults
summary: >-
  Generation of Error Message Containing Sensitive Information vulnerability in
  Apache Juneau.


  The REST server sends the internal exception class and message to clients in a
  "Thrown" response header on every error response, and can includ…
severity: critical
cvss: 10
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'
cvssSource: cna
cwe:
  - CWE-209
vendor: Apache Software Foundation
product: 'org.apache.juneau:juneau-rest-server.'
affected:
  - 'org.apache.juneau:juneau-rest-server. < 9.2.1'
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T11:52:25.335Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-73101'
references:
  - url: 'https://lists.apache.org/thread.html/j05q7vw08j48o96tdlzcsd4sozx1lyl6'
tags:
  - cve.org
ingestedAt: '2026-11-05T21:36:00.828Z'
---

## Overview

Generation of Error Message Containing Sensitive Information vulnerability in Apache Juneau.

The REST server sends the internal exception class and message to clients in a "Thrown" response header on every error response, and can include internal exception messages in the error body, even when stack-trace rendering is disabled. This reveals implementation details to remote clients.

This issue affects Apache Juneau: through 9.2.0.

Users are recommended to upgrade to version 9.2.1, which fixes the issue.

## Affected

- `org.apache.juneau:juneau-rest-server. < 9.2.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.