CVE-2026-73095 in Juneau
Summary
by MITRE • 11/05/2026
Allocation of Resources Without Limits or Throttling vulnerability in Apache Juneau.
The MessagePack parser, which the REST server enables by default, sizes buffers from length values in the input. An unauthenticated client can send a few bytes that force a multi-gigabyte allocation and an OutOfMemoryError, causing denial of service. Related unbounded allocations in REST request handling (multipart uploads and request reader buffers) are fixed at the same time.
This issue affects Apache Juneau: through 9.2.0.
Users are recommended to upgrade to version 9.2.1, which fixes the issue.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified in Apache Juneau represents a critical failure in resource management within its REST server implementation, specifically affecting the MessagePack parser component. This flaw is categorized under CWE-770 as an Allocation of Resources Without Limits or Throttling, and it aligns with MITRE ATT&CK technique T1496, which involves Resource Hijacking through denial-of-service mechanisms. The core technical issue stems from how the MessagePack parser processes incoming data streams. When a client sends a request containing a length field within the MessagePack payload, the server blindly trusts this value to determine the size of memory buffers required for parsing. There is no validation against maximum allowable buffer sizes or any form of rate limiting applied before the allocation occurs. This design flaw allows an attacker to craft a maliciously small input that contains a large integer in its length field, tricking the application into attempting to allocate several gigabytes of heap space on the server side.
From an operational perspective, this vulnerability enables a highly efficient denial-of-service attack against any system running Apache Juneau with default configurations. Because MessagePack parsing is enabled by default in the REST server, unauthenticated remote attackers can trigger this condition without needing valid credentials or prior interaction with the application beyond sending a single HTTP request containing the crafted payload. The immediate consequence of such an allocation attempt is typically an OutOfMemoryError within the Java Virtual Machine running Apache Juneau. This error often leads to the crash of the entire server process or, in environments where automatic restarts are configured, causes severe performance degradation and latency spikes as the system struggles with garbage collection overhead before eventually failing again. The impact extends beyond simple availability loss; it can also lead to cascading failures if other services depend on this instance for data processing or API responses.
The remediation strategy provided by Apache involves upgrading to version 9.2.1, which addresses not only the MessagePack parsing issue but also related unbounded allocations found in REST request handling mechanisms such as multipart uploads and general request reader buffers. This comprehensive fix ensures that all entry points for data ingestion are properly bounded against excessive resource consumption. For organizations unable to immediately upgrade due to compatibility constraints or deployment cycles, interim mitigations should focus on placing a reverse proxy or Web Application Firewall in front of the Apache Juneau instance. These intermediary systems can be configured with strict payload size limits and request rate limiting rules that prevent any single client from sending oversized messages or flooding the server with requests. Additionally, tuning the Java Virtual Machine heap sizes may provide temporary resilience against smaller-scale attacks but does not address the root cause of unbounded allocation logic within the application itself.
Security teams should also consider implementing strict input validation policies at the network perimeter to filter out malformed packets before they reach the application layer. Regular security assessments and penetration testing focused on resource exhaustion vulnerabilities are recommended to ensure that similar flaws do not exist in other components of the software stack. By adhering to these mitigation steps and promptly applying the vendor-recommended patch, organizations can effectively neutralize this threat vector and maintain the availability and integrity of their RESTful services built upon Apache Juneau.