---
id: "CVE-2026-73095"
kind: "vulnerability"
aliases: ["CVE-2026-73095"]
title: "Apache Juneau: unbounded MessagePack input lets unauthenticated clients exhaust memory"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-juneau", "java", "package", "rest-api"]
not_affected_if: ["juneau-9.2.1-or-later", "no-rest-server"]
published_at: "2026-11-05T12:17:50+00:00"
first_seen_at: "2026-11-05T12:38:47+00:00"
updated_at: "2026-11-05T12:40:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73095", "first_seen_at": "2026-11-05T12:38:47+00:00"}]
exploit_sources: []
---

# Apache Juneau: unbounded MessagePack input lets unauthenticated clients exhaust memory

Apache Juneau's MessagePack parser, enabled by default in its REST server, sizes buffers from length fields in the input. An unauthenticated client can send a few bytes that force a multi-gigabyte allocation and crash the service with an OutOfMemoryError.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Juneau version in the project build file (for example the `juneau` artifact version in `pom.xml` or `build.gradle`).
- Confirm whether the REST server accepts MessagePack requests on a reachable endpoint.

## Fix

- Apache Juneau: upgrade to `9.2.1`.

## Timeline

- 2026-11-05T12:38:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-73095

## From the sources

Allocation of Resources Without Limits or Throttling vulnerability in Apache Juneau.

The MessagePack parser, which the REST server enables by default, sizes buffers from length values in the input. An unauthenticated client can send a few bytes that force a multi-gigabyte allocation and an OutOfMemoryError, causing denial of service. Related unbounded allocations in REST request handling (multipart uploads and request reader buffers) are fixed at the same time.

This issue affects Apache Juneau: through 9.2.0.

Users are recommended to upgrade to version 9.2.1, which fixes the issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_