org.apache.juneau:juneau-marshall vulnerabilities
CVEs whose affected-version data names the org.apache.juneau:juneau-marshall package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-73095High· 8.7Apache Juneau: Denial of service via unbounded memory allocation in parsers and REST request handling
Allocation of Resources Without Limits or Throttling vulnerability in Apache Juneau. The MessagePack parser, which the REST server enables by default, sizes buffers from length values in the input. An unauthenticated client can send a f…
CVE-2026-73098Critical· 10.0Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during parsing
Improper control of dynamically-loaded code vulnerability in Apache Juneau. When Apache Juneau parses a value into a property of type java.lang.Class (including parameterized forms), the default class swap loaded the named class with in…
CVE-2026-96677Critical· 10.0Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Juneau. HTML document serialization does not HTML-encode variable substitutions in the page chrome (header, nav, aside, footer …