CVE-2026-73101 PUBLISHED

Apache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaults

Assigner: apache
Reserved: 10.08.2026 Published: 05.11.2026 Updated: 05.11.2026

Generation of Error Message Containing Sensitive Information vulnerability in Apache Juneau.

The REST server sends the internal exception class and message to clients in a "Thrown" response header on every error response, and can include internal exception messages in the error body, even when stack-trace rendering is disabled. This reveals implementation details to remote clients.

This issue affects Apache Juneau: through 9.2.0.

Users are recommended to upgrade to version 9.2.1, which fixes the issue.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS Score: 10

Product Status

Vendor Apache Software Foundation
Product Apache Juneau
Versions Default: unaffected
  • affected from 0 to 9.2.1 (excl.)

References

Problem Types

  • CWE-209 Generation of Error Message Containing Sensitive Information CWE