Loading vulnerability…
Internal Exception Disclosure in Apache Juneau REST Server
CVE-2026-73101 is an information-disclosure vulnerability affecting Apache Juneau juneau-rest-server through version 9.2.0. The REST server includes internal exception class names and messages in the Thrown response header on every error response and may also include internal exception messages in error-response bodies. These details remain exposed even when stack-trace rendering is disabled, revealing internal implementation information to remote clients.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Remote clients can obtain internal exception class names and messages, compromising the confidentiality of implementation details and any sensitive information contained in those messages. The disclosed information can support application reconnaissance and further targeted attacks; the specific data exposed depends on the exceptions generated by the application.
If you can’t patch tonight, do this now.
No interim workaround is specified. Disabling stack-trace rendering does not prevent disclosure in affected versions.
Patch, then assume compromise.
Upgrade Apache Juneau juneau-rest-server to version 9.2.1, including shaded or aggregate artifacts that embed the affected module. Version 9.2.1 suppresses internal exception details in client responses by default. Avoid explicitly enabling @Rest(renderResponseStackTraces="true") unless disclosure of these details is intentional and appropriately restricted.
No public exploits tracked yet. Mallory keeps watching.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.