CVE-2026-73095 · Package
NO FIX YET · SEE WHAT TO DO
Apache Juneau's MessagePack parser, enabled by default in its REST server, sizes buffers from length fields in the input. An unauthenticated client can send a few bytes that force a multi-gigabyte allocation and crash the service with an OutOfMemoryError.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Services built on Apache Juneau 9.2.0 and earlier that run the REST server with its default MessagePack parser exposed to clients. The sources say the flaw is reachable without authentication, so any service accepting untrusted requests on that endpoint is exposed. Projects that do not run the Juneau REST server, or that only use it internally, can likely skip it.
Not affected if juneau-9.2.1-or-later, no-rest-server
Who cares apache-juneau, java, rest-api
juneau artifact version in pom.xml or build.gradle).9.2.1.Allocation of Resources Without Limits or Throttling vulnerability in Apache Juneau.
The MessagePack parser, which the REST server enables by default, sizes buffers from length values in the input. An unauthenticated client can send a few bytes that force a multi-gigabyte allocation and an OutOfMemoryError, causing denial of service. Related unbounded allocations in REST request handling (multipart uploads and request reader buffers) are fixed at the same time.
This issue affects Apache Juneau: through 9.2.0.
Users are recommended to upgrade to version 9.2.1, which fixes the issue.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.