Apache Juneau 9.2.1 Fixes Nine Flaws, Including Credential Disclosure and Path Traversal
Vulnerability Disclosure · 2 sources · Updated 17h ago · First seen Nov 5, 2026
Apache released Juneau 9.2.1 to fix nine vulnerabilities affecting versions through 9.2.0. The flaws cover denial of service, path traversal, cross-site scripting, cross-site request forgery, credential disclosure, internal exception disclosure, unsafe class initialization, and response-header injection or open redirects. Some affect default configurations; others depend on application settings or the handling of untrusted input. The release addresses CVE-2026-73095, CVE-2026-121489, CVE-2026-96677, CVE-2026-73099, CVE-2026-73100, CVE-2026-73101, CVE-2026-73098, CVE-2026-73116, and CVE-2026-73117.
Organizations should upgrade affected modules and aggregate artifacts, review logs for exposed credentials, and assess the release’s changed defaults before deployment. Upgrading alone does not prevent credential forwarding by application-supplied HTTP clients or make unsafe application redirects safe; those behaviors require application-level review and remediation. Juneau’s security documentation provides guidance on handling untrusted input across its serializers, parsers, SVL, and REST layers, alongside automated Java security and quality checks using CodeQL and SonarCloud.
