CVE-2026-73100: falha crítica em Apache Juneau
Apache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errors
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 10epss 0.4%
Insertion of Sensitive Information into Log File vulnerability in Apache Juneau.
The default REST server call logger records request headers for requests that end in a server error, without redacting them. Any client able to cause a server error gets headers such as Authorization, Cookie, Proxy-Authorization and X-API-Key written in cleartext to the application log, exposing them to anyone who can read the logs.
This issue affects Apache Juneau: through 9.2.0.
Users are recommended to upgrade to version 9.2.1, which fixes the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Produtos afetados
Apache Software Foundation · Apache JuneauCVEs relacionadas — Apache Juneau
No mesmo produto, das mais perigosas para as menos.
CVE-2026-121489CRITICALApache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directoryEPSS 0.5%CVE-2026-73098CRITICALApache Juneau: Unsafe reflection allows attacker-controlled class initialization during parsingEPSS 0.5%CVE-2026-96677CRITICALApache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chromeEPSS 0.4%CVE-2026-73117CRITICALApache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request dataEPSS 0.4%CVE-2026-73101CRITICALApache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaultsEPSS 0.4%CVE-2026-73095HIGHApache Juneau: Denial of service via unbounded memory allocation in parsers and REST request handlingEPSS 0.4%