CVE-2026-73099: Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body override

Published Nov 4, 2026

Updated

Cross-Site Request Forgery (CSRF) vulnerability in Apache Juneau.

The REST server accepts a "content" query parameter that replaces the request body, and this is enabled by default on every HTTP method, including GET. A cross-site link can therefore deliver an attacker-chosen request body to an endpoint without a CORS preflight, defeating protections that rely on the HTTP method or content type instead of an anti-CSRF token.

This issue affects Apache Juneau: through 9.2.0.

Users are recommended to upgrade to version 9.2.1, which fixes the issue. Applications that do not use the content parameter can also set disableContentParam to true.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Juneau to a version that resolves this vulnerability.
Fixed in 9.2.1
Configuration
Set disableContentParam to true when the application does not use the content query parameter.
Apache Juneau REST server disableContentParam = true

Event History

Nov 5, 2026

CVE Published

via MITRE·11:50 AM

Data Sourced

via MITRE·11:50 AM

DescriptionWeakness

Data Sourced

via NVD·12:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed by default?

Apache Juneau REST servers through version 9.2.0 are exposed because acceptance of the content query parameter is enabled by default for every HTTP method, including GET.

What does an attacker need to exploit this issue?

An attacker can use a cross-site link to send an attacker-controlled request body through the content query parameter. The issue does not require a CORS preflight and can bypass defenses that rely only on request method or content type rather than an anti-CSRF token.

What can be done if upgrading is not immediately possible?

If the application does not use the content parameter, set disableContentParam to true. Otherwise, use anti-CSRF tokens rather than relying on HTTP method or content-type restrictions.

How can I determine whether my application is affected?

Check whether the application uses Apache Juneau version 9.2.0 or earlier and operates a REST server with the default content-parameter behavior. Also determine whether endpoints rely on method- or content-type-based CSRF protections without anti-CSRF tokens.

CVE-2026-73099: Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body override

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed by default?

What does an attacker need to exploit this issue?

What can be done if upgrading is not immediately possible?

How can I determine whether my application is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed by default?

What does an attacker need to exploit this issue?

What can be done if upgrading is not immediately possible?

How can I determine whether my application is affected?