org.apache.juneau:juneau-rest-server vulnerabilities
CVEs whose affected-version data names the org.apache.juneau:juneau-rest-server package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-73095High· 8.7Apache Juneau: Denial of service via unbounded memory allocation in parsers and REST request handling
Allocation of Resources Without Limits or Throttling vulnerability in Apache Juneau. The MessagePack parser, which the REST server enables by default, sizes buffers from length values in the input. An unauthenticated client can send a f…
CVE-2026-73117Critical· 10.0Apache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request data
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability in Apache Juneau. The Apache Juneau REST server passed response header values and redirect targets to the servlet container unchecked. A…
CVE-2026-73100Critical· 10.0Apache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errors
Insertion of Sensitive Information into Log File vulnerability in Apache Juneau. The default REST server call logger records request headers for requests that end in a server error, without redacting them. Any client able to cause a ser…