Quick answers
- Is CVE-2026-73117 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-73117 being exploited in the wild.
- How severe is CVE-2026-73117?
- Informational severity, published 5 November 2026.
- Which products and versions are affected?
- Apache Juneau through 9.2.0.
- Is there a fix for CVE-2026-73117?
- Yes: fixed in 9.2.1. Until then: Applications that build redirect targets from request data must switch from sendRedirect() to the new sendSafeRedirect() method in version 9.2.1 to ensure safe redirects. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-73117 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-73117?
- Check whether you run Apache Juneau at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 9.2.1
Applications that build redirect targets from request data must switch from sendRedirect() to the new sendSafeRedirect() method in version 9.2.1 to ensure safe redirects.
Technical details
The REST server in Apache Juneau passes response header values and redirect targets to the servlet container without sanitizing carriage return and line feed (CRLF) characters, enabling HTTP response splitting attacks. Exploitation requires application code that builds headers or redirect targets from untrusted request data; the framework itself does not do so by default. The vulnerability is patched in version 9.2.1 with automatic header sanitization and a new sendSafeRedirect() method.
Affected products
- Apache Juneau through 9.2.0
Timeline
- 2026-11-05: disclosed