CVE-2026-96677criticalCWE-79

CVE-2026-96677: falha crítica em Apache Juneau

Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome

Publicada em

Seguir esta CVE+ Monitorar Apache Juneau

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 10epss 0.4%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Juneau. HTML document serialization does not HTML-encode variable substitutions in the page chrome (header, nav, aside, footer and similar fields). Applications whose chrome includes request-derived variables, such as request headers, form data or path values, reflect those values unencoded, allowing cross-site scripting. The default chrome does not use request variables, so only applications that add them are affected. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Produtos afetados
Apache Software Foundation · Apache Juneau
CVEs relacionadas — Apache Juneau

No mesmo produto, das mais perigosas para as menos.

CVE-2026-121489CRITICALApache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directoryEPSS 0.5%CVE-2026-73098CRITICALApache Juneau: Unsafe reflection allows attacker-controlled class initialization during parsingEPSS 0.5%CVE-2026-73117CRITICALApache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request dataEPSS 0.4%CVE-2026-73101CRITICALApache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaultsEPSS 0.4%CVE-2026-73100CRITICALApache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errorsEPSS 0.4%CVE-2026-73095HIGHApache Juneau: Denial of service via unbounded memory allocation in parsers and REST request handlingEPSS 0.4%