CVE-2026-73116: Apache Software Foundation Apache Juneau, заобикаляне

Описание

Оригинално описание

Insufficiently Protected Credentials vulnerability in Apache Juneau. The Apache Juneau RestClient followed HTTP redirects while keeping credential headers from the original request, so a server that redirected the client to a different host or port, or from HTTPS to HTTP, could receive headers such as Authorization, Cookie, Proxy-Authorization and X-API-Key. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue. The fix applies to HTTP clients created by the RestClient builder; applications that supply their own HttpClient must disable automatic redirects or strip credential headers on cross-origin redirects themselves.

Засегнати продукти

• Apache Software Foundation Apache Juneau: преди 9.2.1
• Apache Software Foundation Apache Juneau: преди 9.2.1

Вид слабост

• CWE-522 Недостатъчно защитени удостоверителни данни

История

Други уязвимости в Apache Software Foundation Apache Juneau

• 10.0CVE-2026-121489
• 10.0CVE-2026-96677
• 10.0CVE-2026-73117
• 10.0CVE-2026-73101
• 10.0CVE-2026-73100

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-73116
• https://nvd.nist.gov/vuln/detail/CVE-2026-73116
• https://lists.apache.org/thread.html/j05q7vw08j48o96tdlzcsd4sozx1lyl6