Resource Allocation Vulnerability in Apache Juneau
CVE-2026-73095

8.7HIGH

Key Information:

Vendor

Apache
Status
Apache Juneau
Vendor
CVE Published:
5 November 2026

What is CVE-2026-73095?

The Apache Juneau framework has a vulnerability that allows for unbounded resource allocation due to improper handling of MessagePack parser inputs. An unauthenticated attacker can exploit this by sending specially crafted inputs that lead to multi-gigabyte memory allocation, resulting in an OutOfMemoryError. This situation can lead to a denial of service. The issue primarily affects version 9.2.0 of Apache Juneau, and it is essential for users to upgrade to version 9.2.1 to mitigate the risk.

Affected Version(s)

Apache Juneau 0 < 9.2.1

Apache Juneau 0 < 9.2.1

References

https://lists.apache.org/thread.html/j05q7vw08j48o96tdlzc...
vendor-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

n0mi1k
.