CVE-2026-73095 Details
Description
Allocation of Resources Without Limits or Throttling vulnerability in Apache Juneau. The MessagePack parser, which the REST server enables by default, sizes buffers from length values in the input. An unauthenticated client can send a few bytes that force a multi-gigabyte allocation and an OutOfMemoryError, causing denial of service. Related unbounded allocations in REST request handling (multipart uploads and request reader buffers) are fixed at the same time. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue.
A denial-of-service vulnerability has been identified in Apache Juneau versions through 9.2.0, specifically within the MessagePack parser of the REST server. This vulnerability allows an unauthenticated client to cause a multi-gigabyte memory allocation by sending a few bytes that manipulate the buffer size. The resulting OutOfMemoryError disrupts service. Additionally, related unbounded memory allocations in REST request handling, such as multipart uploads and request reader buffers, are addressed in the same update.
Users are advised to upgrade to Apache Juneau version 9.2.1, which addresses this vulnerability. If an immediate upgrade is not possible, MsgPackParser should be removed from resources that accept untrusted input, and a request size limit can be implemented to reduce exposure.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 5, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://lists.apache.org/thread.html/j05q7vw08j48o96tdlzcsd4sozx1lyl6 | [email protected] | AdvisoryBundleMailing ListRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Apache Juneau | <= 9.2.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Nov 5, 2026 | New CVE Received | [email protected] |