CVE-2026-73095
Allocation of Resources Without Limits or Throttling vulnerability in Apache Juneau. The…
- Risk score
- 57/100
- CVSS
- 8.7 v4.0
- Published
- 5 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Allocation of Resources Without Limits or Throttling vulnerability in Apache Juneau. The MessagePack parser, which the REST server enables by default, sizes buffers from length values in the input. An unauthenticated client can send a few bytes that force a multi-gigabyte allocation and an OutOfMemoryError, causing de…
- Affected
- See advisory
- Fix
- Upgrade the product to 9.2.1 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.7 high
- Remotely exploitable without logging in
References
Original description
Allocation of Resources Without Limits or Throttling vulnerability in Apache Juneau. The MessagePack parser, which the REST server enables by default, sizes buffers from length values in the input. An unauthenticated client can send a few bytes that force a multi-gigabyte allocation and an OutOfMemoryError, causing denial of service. Related unbounded allocations in REST request handling (multipart uploads and request reader buffers) are fixed at the same time. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue.
Last activity 5 Nov 2026. Patch Forecast updates every hour.