CVE-2026-73095
Received Received - Intake

Allocation of Resources Without Limits or Throttling in Apache Juneau

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: Apache Software Foundation

Description
Allocation of Resources Without Limits or Throttling vulnerability in Apache Juneau. The MessagePack parser, which the REST server enables by default, sizes buffers from length values in the input. An unauthenticated client can send a few bytes that force a multi-gigabyte allocation and an OutOfMemoryError, causing denial of service. Related unbounded allocations in REST request handling (multipart uploads and request reader buffers) are fixed at the same time. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-73095
EUVD
EUVD-2026-117406

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apache Software Foundation Apache Juneau 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Allocation of Resources Without Limits or Throttling vulnerability in Apache Juneau. The MessagePack parser, enabled by default in the REST server, reads length values from input to size buffers. An unauthenticated attacker can send a small payload that forces the server to allocate multi-gigabyte memory, causing an OutOfMemoryError and denial of service.

Detection Guidance

Detecting this vulnerability requires monitoring for unusually large memory allocations or OutOfMemoryError exceptions in Apache Juneau REST servers. Check application logs for OutOfMemoryError messages or excessive memory usage during request handling. Monitor network traffic for unusually large payloads, especially in MessagePack or multipart upload formats.

Impact Analysis

This vulnerability can cause your Apache Juneau REST server to crash due to excessive memory allocation, leading to service disruption. Attackers can exploit it remotely without authentication, making it a critical risk for systems running affected versions.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt services handling personal or health data. Uncontrolled resource allocation may lead to service unavailability, potentially violating availability requirements in these regulations.

Mitigation Strategies

Upgrade Apache Juneau to version 9.2.1 or later immediately. If upgrading is not immediately possible, disable the MessagePack parser in the REST server configuration and restrict access to the REST endpoint via network controls until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73095. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...