CVE-2026-73101 Apache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaults

CriticalCVSS 10.0

Published: 2026-11-05 13:52
Updated: 2026-11-10 20:58
Exploit status: No public exploit known

Description

Generation of Error Message Containing Sensitive Information vulnerability in Apache Juneau.

The REST server sends the internal exception class and message to clients in a "Thrown" response header on every error response, and can include internal exception messages in the error body, even when stack-trace rendering is disabled. This reveals implementation details to remote clients.

This issue affects Apache Juneau: through 9.2.0.

Users are recommended to upgrade to version 9.2.1, which fixes the issue.

Affected products

Product	Affected versions	Fixed in
org.apache.juneau/juneau-rest-server.(Maven)	< 9.2.1	9.2.1

References

lists.apache.org vendor-advisory

CVSS v4.0

10.0 Critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: None
User Interaction: None
Vulnerable System Confidentiality: High
Vulnerable System Integrity: High
Vulnerable System Availability: High
Subsequent System Confidentiality: High
Subsequent System Integrity: High
Subsequent System Availability: High

Weakness & likelihood

EPSS (exploitation probability, 30 days): Not available
CWE: CWE-209 Generation of Error Message Containing Sensitive Information

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.