Sensitive Information Exposure in Apache Juneau REST Server

CVE-2026-73101

What is CVE-2026-73101?

The Apache Juneau REST server is affected by a vulnerability that causes it to expose sensitive information through error messages. When an error occurs, the server sends internal exception information, including the exception class and message, in the 'Thrown' response header. This information can also appear in the error body, even with stack-trace rendering disabled, which can inadvertently reveal critical implementation details to remote clients. Users are strongly advised to upgrade to version 9.2.1 or later to remediate this issue.

References