{"id":"CVE-2026-73095","kind":"vulnerability","aliases":["CVE-2026-73095"],"related":[],"title":"Apache Juneau: unbounded MessagePack input lets unauthenticated clients exhaust memory","description":"Allocation of Resources Without Limits or Throttling vulnerability in Apache Juneau.\n\nThe MessagePack parser, which the REST server enables by default, sizes buffers from length values in the input. An unauthenticated client can send a few bytes that force a multi-gigabyte allocation and an OutOfMemoryError, causing denial of service. Related unbounded allocations in REST request handling (multipart uploads and request reader buffers) are fixed at the same time.\n\nThis issue affects Apache Juneau: through 9.2.0.\n\nUsers are recommended to upgrade to version 9.2.1, which fixes the issue.","summary":"Apache Juneau's MessagePack parser, enabled by default in its REST server, sizes buffers from length fields in the input. An unauthenticated client can send a few bytes that force a multi-gigabyte allocation and crash the service with an OutOfMemoryError.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-juneau","java","package","rest-api"],"not_affected_if":["juneau-9.2.1-or-later","no-rest-server"],"how_to_check":"- Check the Juneau version in the project build file (for example the `juneau` artifact version in `pom.xml` or `build.gradle`).\n- Confirm whether the REST server accepts MessagePack requests on a reachable endpoint.","fix":"- Apache Juneau: upgrade to `9.2.1`.","status":"open","published_at":"2026-11-05T12:17:50+00:00","first_seen_at":"2026-11-05T12:38:47+00:00","triaged_at":"2026-11-05T12:40:09+00:00","updated_at":"2026-11-05T12:40:09+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T12:40:09Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Juneau: upgrade to `9.2.1`.","reach":"internet","title":"Apache Juneau: unbounded MessagePack input lets unauthenticated clients exhaust memory","impact":"medium","summary":"Apache Juneau's MessagePack parser, enabled by default in its REST server, sizes buffers from length fields in the input. An unauthenticated client can send a few bytes that force a multi-gigabyte allocation and crash the service with an OutOfMemoryError.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","apache-juneau","rest-api"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Remote clients crash the service via memory exhaustion","analyst_note":"","how_to_check":"- Check the Juneau version in the project build file (for example the `juneau` artifact version in `pom.xml` or `build.gradle`).\n- Confirm whether the REST server accepts MessagePack requests on a reachable endpoint.","plain_action":"","needs_analyst":false,"not_affected_if":["juneau-9.2.1-or-later","no-rest-server"],"who_is_affected":"Services built on Apache Juneau 9.2.0 and earlier that run the REST server with its default MessagePack parser exposed to clients. The sources say the flaw is reachable without authentication, so any service accepting untrusted requests on that endpoint is exposed. Projects that do not run the Juneau REST server, or that only use it internally, can likely skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000715,"input_tokens":4321,"output_tokens":565,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-73095':13A,16A '9.2.0':143C '9.2.1':151C 'affect':139C 'alloc':59B,67C,110C,120C 'apach':1A,18B,25B,76C,140C 'apache-juneau':17B 'api':24B 'buffer':38B,89C,130C 'byte':52B,103C 'caus':114C 'client':8A,47B,98C 'crash':61B 'cve':11A,14A 'default':32B,87C 'denial':115C 'enabl':30B,85C 'exhaust':9A 'field':41B 'fix':132C,153C 'forc':54B,105C 'gigabyt':58B,109C 'handl':124C 'input':5A,44B,95C 'issu':138C,155C 'java':20B 'juneau':2A,19B,26B,77C,141C 'length':40B,91C 'let':6A 'limit':71C 'memori':10A 'messagepack':4A,28B,79C 'multi':57B,108C 'multi-gigabyt':56B,107C 'multipart':125C 'outofmemoryerror':66B,113C 'packag':21B 'parser':29B,80C 'reader':129C 'recommend':146C 'relat':118C 'request':123C,128C 'resourc':69C 'rest':23B,35B,83C,122C 'rest-api':22B 'send':49B,100C 'server':36B,84C 'servic':63B,117C 'size':37B,88C 'throttl':73C 'time':136C 'unauthent':7A,46B,97C 'unbound':3A,119C 'upgrad':148C 'upload':126C 'user':144C 'valu':92C 'version':150C 'vulner':74C 'without':70C","nicknames":[],"mitigations":[],"who_affected":"Services built on Apache Juneau 9.2.0 and earlier that run the REST server with its default MessagePack parser exposed to clients. The sources say the flaw is reachable without authentication, so any service accepting untrusted requests on that endpoint is exposed. Projects that do not run the Juneau REST server, or that only use it internally, can likely skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apachejuneau","high","java","package","restapi"],"campaign_type":null,"first_public_at":"2026-11-05T12:17:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-73095","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73095","severity":null,"published_at":"2026-11-05T12:17:50+00:00","modified_at":"2026-11-05T12:17:50+00:00","first_seen_at":"2026-11-05T12:38:47+00:00","fetched_at":"2026-11-05T12:38:47+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}