Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
CVE-2026-73117: Apache Juneau allows header injection and open redirects
CVE-2026-73117 · published 4 days ago
Summary
Apache Juneau versions up to 9.2.0 can pass data from a web request straight into response headers or redirect URLs. If an application uses request data for these, an attacker could add extra header lines or send users to a malicious site. Upgrade to version 9.2.1 and use the new safe redirect method to protect against this.
What to do
- Update apache software foundation apache juneau to version 9.2.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| apache software foundation | apache juneau | < 9.2.1 |
Original advisory text
Apache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request data
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability in Apache Juneau.
The Apache Juneau REST server passed response header values and redirect targets to the servlet container unchecked. An application that sets a response header or redirect target from request data could let a remote client inject header lines (where the servlet container does not itself reject CR/LF) or redirect users to an arbitrary external site. The framework itself does not build headers or redirects from request data; exposure depends on application code.
This issue affects Apache Juneau: through 9.2.0.
Users are recommended to upgrade to version 9.2.1, which fixes the issue. Header values are now sanitized by default; applications that build redirect targets from request data must also switch from sendRedirect() to the new sendSafeRedirect().
The Apache Juneau REST server passed response header values and redirect targets to the servlet container unchecked. An application that sets a response header or redirect target from request data could let a remote client inject header lines (where the servlet container does not itself reject CR/LF) or redirect users to an arbitrary external site. The framework itself does not build headers or redirects from request data; exposure depends on application code.
This issue affects Apache Juneau: through 9.2.0.
Users are recommended to upgrade to version 9.2.1, which fixes the issue. Header values are now sanitized by default; applications that build redirect targets from request data must also switch from sendRedirect() to the new sendSafeRedirect().
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-113Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
Timeline
Published5 Nov 2026
Updated6 Nov 2026
First seen5 Nov 2026
Track software like this
Free during beta