Apache Juneau Java library: several flaws fixed
A Java program part that can let attackers stop servers or leak information!
Summary
Apache Juneau is a Java library that programs build in. Versions through 9.2.0 have several flaws, including memory exhaustion that can stop a server, and some can be used without logging in.
Affected when
- Apache Juneau REST server in use
What to do
Update to version 9.2.1. For the CSRF flaw, applications that do not use the content parameter can set disableContentParam to true.
Products and platforms
CVE IDs
- CVE-2026-73095 (opens in a new tab)
- CVE-2026-73098 (opens in a new tab)
- CVE-2026-73099 (opens in a new tab)
- CVE-2026-73100 (opens in a new tab)
- CVE-2026-73101 (opens in a new tab)
- CVE-2026-73116 (opens in a new tab)
- CVE-2026-73117 (opens in a new tab)
- CVE-2026-96677 (opens in a new tab)
- CVE-2026-121489 (opens in a new tab)
Sources
- Advisory: lists.apache.org (opens in a new tab)
- CVE record: cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab)
- KISA notice: KISA 보호나라: Apache 제품 보안 업데이트 권고 (opens in a new tab)
Times
First published
First seen