Cross-site Scripting Vulnerability in Apache Juneau
CVE-2026-96677

10CRITICAL

Key Information:

Vendor

Apache
Status
Apache Juneau
Vendor
CVE Published:
5 November 2026

What is CVE-2026-96677?

The vulnerability in Apache Juneau arises from improper handling of input during web page generation, specifically in the serialization of HTML documents. It fails to properly encode variable substitutions in the page chrome elements—such as headers, navigation bars, and footers—allowing potentially malicious input to be reflected unencoded. Applications that integrate request-derived values like request headers, form data, or path components could expose themselves to cross-site scripting attacks. It is crucial for users utilizing affected versions to upgrade to 9.2.1 to mitigate the risk associated with this vulnerability.

Affected Version(s)

Apache Juneau 0 < 9.2.1

References

https://lists.apache.org/thread.html/j05q7vw08j48o96tdlzc...
vendor-advisory

CVSS V4

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

姬珏 (Diana Wang)
.