Loading vulnerability…
Unauthenticated Memory Exhaustion in Apache Juneau MessagePack Parser
CVE-2026-73095 is an uncontrolled resource allocation vulnerability affecting Apache Juneau juneau-marshall and juneau-rest-server through version 9.2.0. MsgPackParser sizes buffers using attacker-controlled length fields without adequate limits. A MessagePack request body containing only a few bytes can trigger multi-gigabyte allocations and an OutOfMemoryError, causing denial of service. The REST server's default BasicUniversalConfig includes MsgPackParser, exposing default REST resources to unauthenticated attacks. Related unbounded allocations affect multipart uploads that bypass maxInput and request-reader buffers sized from client-supplied Content-Length values.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Remote, unauthenticated attackers can exhaust application memory and cause denial of service with very small requests. The vulnerability has high availability impact on the affected system; no confidentiality or integrity impact, or impact on subsequent systems, is identified.
If you can’t patch tonight, do this now.
If upgrading is not immediately possible, remove MsgPackParser from REST resources accepting untrusted input. Upstream request-size limits alone do not eliminate the MessagePack exposure because a few input bytes can declare lengths that trigger very large allocations. Removing MsgPackParser does not address the related multipart and request-reader allocation issues.
Patch, then assume compromise.
Upgrade Apache Juneau juneau-marshall and juneau-rest-server to version 9.2.1, including shaded and aggregate artifacts embedding affected modules. Version 9.2.1 introduces a configurable parser-length cap of 16 MiB by default, converts parsing OutOfMemoryError conditions into parse failures, and fixes related multipart and request-reader allocation issues. It also lowers the default maxInput from 100 MB to 1 MB; applications requiring larger request bodies should explicitly configure @Rest(maxInput) with an appropriate limit.
No public exploits tracked yet. Mallory keeps watching.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.