CVE-2026-73117: Apache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request data

Published Nov 3, 2026

Updated

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability in Apache Juneau.

The Apache Juneau REST server passed response header values and redirect targets to the servlet container unchecked. An application that sets a response header or redirect target from request data could let a remote client inject header lines (where the servlet container does not itself reject CR/LF) or redirect users to an arbitrary external site. The framework itself does not build headers or redirects from request data; exposure depends on application code.

This issue affects Apache Juneau: through 9.2.0.

Users are recommended to upgrade to version 9.2.1, which fixes the issue. Header values are now sanitized by default; applications that build redirect targets from request data must also switch from sendRedirect() to the new sendSafeRedirect().

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Juneau to a version that resolves this vulnerability.
Fixed in 9.2.1
Configuration
When building redirect targets from request data, replace sendRedirect() with sendSafeRedirect().
Apache Juneau applications redirect method = sendSafeRedirect()

Event History

Nov 5, 2026

CVE Published

via MITRE·11:54 AM

Data Sourced

via MITRE·11:54 AM

DescriptionWeakness

Data Sourced

via NVD·12:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which applications are exposed to this issue?

Exposure depends on application code. Applications are affected when they pass request-derived data into response header values or redirect targets through Apache Juneau; the framework does not do this on its own.

What does an attacker need to exploit it?

A remote client must be able to supply request data that the application uses in a response header or redirect target. Header injection additionally depends on the underlying servlet container not rejecting CR/LF characters.

Are default Apache Juneau applications affected?

Not solely because they use Apache Juneau. The issue requires application code that constructs response headers or redirects from request-controlled input.

What should be done if redirect targets are built from request data?

Upgrade to version 9.2.1 and replace sendRedirect() with the new sendSafeRedirect() for redirects whose targets are derived from request data. The upgrade sanitizes header values by default, but redirect handling requires this application change.

How can teams identify potentially affected code?

Review application code for response headers whose values come from request data and for uses of sendRedirect() where the target is influenced by request data. Such code should be treated as exposed until header input is sanitized and request-derived redirects use sendSafeRedirect().

CVE-2026-73117: Apache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request data

Remediation

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit it?

Are default Apache Juneau applications affected?

What should be done if redirect targets are built from request data?

How can teams identify potentially affected code?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit it?

Are default Apache Juneau applications affected?

What should be done if redirect targets are built from request data?

How can teams identify potentially affected code?