HTTP Response Splitting Vulnerability in Apache Juneau
CVE-2026-73117

10CRITICAL

Key Information:

Vendor

Apache
Status
Apache Juneau
Vendor
CVE Published:
5 November 2026

What is CVE-2026-73117?

An improper neutralization vulnerability in the Apache Juneau REST server allows for HTTP response splitting, enabling remote clients to inject malicious header lines or redirect users to harmful external sites. The server indiscriminately processes response header values and redirect targets from request data, posing significant risks if application code does not adequately handle this input. It is crucial for users of Apache Juneau to upgrade to version 9.2.1, where header values are sanitized by default, promoting safer practices and ensuring that applications utilizing request data for redirects transition to the sendSafeRedirect() function.

Affected Version(s)

Apache Juneau 0 < 9.2.1

References

https://lists.apache.org/thread.html/j05q7vw08j48o96tdlzc...
vendor-advisory

CVSS V4

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.