CVE-2026-73101: Apache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaults

Published Nov 4, 2026

Updated

Generation of Error Message Containing Sensitive Information vulnerability in Apache Juneau.

The REST server sends the internal exception class and message to clients in a "Thrown" response header on every error response, and can include internal exception messages in the error body, even when stack-trace rendering is disabled. This reveals implementation details to remote clients.

This issue affects Apache Juneau: through 9.2.0.

Users are recommended to upgrade to version 9.2.1, which fixes the issue.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Juneau to a version that resolves this vulnerability.
Fixed in 9.2.1

Event History

Nov 5, 2026

CVE Published

via MITRE·11:52 AM

Data Sourced

via MITRE·11:52 AM

DescriptionWeakness

Data Sourced

via NVD·12:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Are applications using the default secure error-handling settings affected?

Yes. Internal exception class and message data can be sent in the "Thrown" response header on every error response regardless of secure defaults. Internal exception messages can also appear in the error body even when stack-trace rendering is disabled.

What does an attacker need to exploit this issue?

A remote client only needs to trigger an error response from an affected Apache Juneau REST server. No authentication or user interaction is indicated by the supplied severity vector.

Which versions should be remediated, and what is the fix?

Apache Juneau versions through 9.2.0 are affected. Upgrade to version 9.2.1, which fixes the issue.

How can I determine whether a server is exposing the information?

Trigger an error response and inspect both the response headers and body. An affected server may return an internal exception class and message in the "Thrown" header, and may include internal exception messages in the error body.

CVE-2026-73101: Apache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaults

Remediation

Event History

Frequently Asked Questions

Are applications using the default secure error-handling settings affected?

What does an attacker need to exploit this issue?

Which versions should be remediated, and what is the fix?

How can I determine whether a server is exposing the information?

Company

Resources

Contact

Frequently Asked Questions

Are applications using the default secure error-handling settings affected?

What does an attacker need to exploit this issue?

Which versions should be remediated, and what is the fix?

How can I determine whether a server is exposing the information?