Apache Juneau up to 9.2.0 HTTP Response sendRedirect response splitting

Summaryinfo

A vulnerability has been found in Apache Juneau up to 9.2.0 and classified as critical. This issue affects the function sendRedirect of the component HTTP Response. This manipulation causes response splitting. This vulnerability appears as CVE-2026-73117. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Apache Juneau up to 9.2.0. It has been declared as critical. Affected by this vulnerability is the function sendRedirect of the component HTTP Response. The manipulation with an unknown input leads to a response splitting vulnerability. The CWE definition for the vulnerability is CWE-113. The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability in Apache Juneau. The Apache Juneau REST server passed response header values and redirect targets to the servlet container unchecked. An application that sets a response header or redirect target from request data could let a remote client inject header lines (where the servlet container does not itself reject CR/LF) or redirect users to an arbitrary external site. The framework itself does not build headers or redirects from request data; exposure depends on application code. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue. Header values are now sanitized by default; applications that build redirect targets from request data must also switch from sendRedirect() to the new sendSafeRedirect().

The advisory is shared at lists.apache.org. This vulnerability is known as CVE-2026-73117 since 08/10/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 11/05/2026).

Upgrading to version 9.2.1 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Apache

Name

• Juneau

Version

• 9.0
• 9.1
• 9.2.0

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion