Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

Apache Juneau reveals internal error details to callers

CVE-2026-73101 · published 4 days ago
Summary

Apache Juneau versions up to 9.2.0 include the internal exception class and message in the response header and sometimes in the error body whenever an error occurs. This can give remote users insight into how the system works, which may help attackers. Upgrade to Apache Juneau 9.2.1 to stop this information from being disclosed.

What to do
  • Update apache software foundation apache juneau to version 9.2.1 or later.
Affected software
VendorProductAffected versions
apache software foundation apache juneau < 9.2.1
Original advisory text
Apache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaults
Generation of Error Message Containing Sensitive Information vulnerability in Apache Juneau.

The REST server sends the internal exception class and message to clients in a "Thrown" response header on every error response, and can include internal exception messages in the error body, even when stack-trace rendering is disabled. This reveals implementation details to remote clients.

This issue affects Apache Juneau: through 9.2.0.

Users are recommended to upgrade to version 9.2.1, which fixes the issue.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-209Generation of Error Message Containing Sensitive Information
Timeline
Published5 Nov 2026
Updated6 Nov 2026
First seen5 Nov 2026
Sources
CVE-2026-73101 · NVD
CVE-2026-73101 · MITRE
Track software like this
Free during beta