A security update has been released to address vulnerabilities in the Apache Juneau products.
The affected products are org.apache.juneau:juneau-rest-server, org.apache.juneau:juneau-rest-common, and org.apache.juneau:juneau-marshall, with versions 9.2.0 and earlier being vulnerable.
CVE-2026-73100 is an information disclosure vulnerability in the Apache Juneau default request logger where sensitive request headers are logged in plain text when a server error occurs.
CVE-2026-96677 is a cross-site scripting vulnerability in Apache Juneau’s HTML document serialization feature caused by unescaped request variables.
Vulnerability Patches have been released in the latest update, and users are advised to update to Apache Juneau version 9.2.1. – An announcement titled “Apache Juneau 9.2.1 fixes multiple vulnerabilities” has been posted on the reference site.
