The Apache Juneau vulnerabilities fixed in version 9.2.1 include eight CVEs that the Apache CNA scores 10.0 on CVSS 4.0. NVD published the records on 5 November 2026. Apache’s own announcement rates the same flaws from low to important, so the two ratings tell different stories.
The Apache Juneau PMC announced the release on its development list and says 9.2.1 was released on 3 November 2026. It fixes nine CVEs, and all of them affect Juneau through 9.2.0. Apache adds that the juneau-shaded and other aggregate artifacts embed the affected modules and need the upgrade too.
Which Apache Juneau Vulnerabilities Score 10.0?
The table follows the Apache announcement and the NVD records. The ninth CVE, CVE-2026-73095, is a denial of service through unbounded memory allocation that the CNA scores 8.7, so it is not in the table. NVD shows the status Deferred for all of them, with only the CNA’s CVSS 4.0 score and no CVSS 3.1 score.
Why Does a Low or Moderate Flaw Carry a 10.0 Score?
The CNA gave all eight the same CVSS 4.0 vector. It reads network access, low complexity, no privileges and no user interaction. It also sets high impact on confidentiality, integrity and availability, for the vulnerable and the subsequent system. Apache’s descriptions set conditions that this vector does not carry.
The log leak needs someone who can read the logs. The cross-site scripting flaw needs request variables in the page chrome, which the default chrome does not use. The header injection needs application code that builds headers or redirects from request data. The path traversal needs three settings that are off by default.
The CSRF row is marked as needing no user interaction, although Apache describes a cross-site link or embedded resource. This comparison is our reading, not Apache’s or NVD’s. We suggest ranking your own work by what your deployment exposes rather than by the shared score.
What Does the Upgrade to 9.2.1 Change?
Apache warns that upgrading changes some defaults. Request bodies over 1 MB need a larger @Rest(maxInput), and error responses no longer carry internal exception detail unless renderResponseStackTraces is on. The content query parameter is now honored only on PUT and POST requests.
Two fixes need action from the application. Code that builds a redirect target from request data must switch from sendRedirect() to sendSafeRedirect(), which 9.2.1 does not do for it. A RestClient built on your own HttpClient is not covered by the redirect fix, so you must handle redirects yourself.
What Do Apache, NVD and CISA KEV Say About Exploitation?
- Fixed versionYesApache Juneau 9.2.1 fixes all nine CVEs in the announcement3 Nov 2026
- Listed in CISA KEVNot seenNone of the Juneau CVEs are in catalogue 2026.11.044 Nov 2026
- NVD analysisUnknownStatus Deferred; the CNA’s CVSS 4.0 score is the only score in the records5 Nov 2026
- CVSS 3.1 scoreNot seenNo CVSS 3.1 score in the NVD records5 Nov 2026
What Should Java Teams Do First?
- Find every use of Juneau, including the juneau-shaded and other aggregate artifacts that embed the affected modules. A software bill of materials makes this faster.
- Upgrade to 9.2.1, Maven group org.apache.juneau, and test the three changed defaults.
- If you cannot upgrade yet, apply Apache’s workarounds. Turn off allowViews, allowUploads and allowDeletes on DirectoryResource, set disableContentParam to true, and remove RQ, RH, RF and RP from HtmlDocConfig chrome fields.
- Review application logs for leaked credentials and rotate any you find, as Apache advises for CVE-2026-73100.
- Check any RestClient built on your own HttpClient, and any code that sets a redirect target from request data.
Steps 1 and 5 are our additions; steps 2 to 4 come from Apache’s announcement. Internet-facing Juneau services fall under exploiting public-facing applications. For finding embedded copies see software bill of materials, for the web flaws see cross-site scripting, and for rollout order see patch management.