10.0 Critical

CVE-2026-73101 Apache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaults

Description

Generation of Error Message Containing Sensitive Information vulnerability in Apache Juneau. The REST server sends the internal exception class and message to clients in a "Thrown" response header on every error response, and can include internal exception messages in the error body, even when stack-trace rendering is disabled. This reveals implementation details to remote clients. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue.

CVSS 4.0 detail

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Exploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: None
Interaction: None
Confidentiality: High
Integrity: High
Availability: High
Confidentiality of other systems: High
Integrity of other systems: High
Availability of other systems: High

Affected products and versions

Product	Affected versions	Fixed in
Apache Juneau 9.2	earliest → < 9.2.1	9.2.1

References

lists.apache.org lists.apache.org

Timeline

Published November 5, 2026
Last modified November 5, 2026

The 9 CVEs of Apache Juneau →

CVE-2026-121489 Apache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directory 10.0 Critical CVE-2026-96677 Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome 10.0 Critical CVE-2026-73117 Apache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request data 10.0 Critical CVE-2026-73116 Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirects 10.0 Critical

Track this CVE