Skip to main content

Release 9.2.1

Date: 11/03/2026

Juneau 9.2.1 is a security and bug-fix release for 9.2.0. It hardens REST server and client defaults, parser input handling and HTML template escaping, and adds no new features.

Several fixes change default behavior; see Upgrade notes before upgrading.

Security fixes​

This release fixes the following vulnerabilities, which affect 9.2.0 and earlier. All users should upgrade. See the security advisory for details.

  • CVE-2026-73095 (important): MessagePack parsing and REST request handling could allocate unbounded memory from untrusted length values.
  • CVE-2026-121489 (moderate): DirectoryResource did not keep requested paths inside its root directory.
  • CVE-2026-96677 (moderate): SVL substitutions in HTML document chrome were not HTML-encoded.
  • CVE-2026-73099 (important): The content query parameter could override the request body on any HTTP method.
  • CVE-2026-73100 (important): The default call logger wrote credential headers to logs.
  • CVE-2026-73101 (moderate): Error responses exposed internal exception details.
  • CVE-2026-73098 (moderate): Parsing a Class value ran the named class's static initializer.
  • CVE-2026-73116 (important): RestClient kept credential headers on cross-origin or HTTPS-to-HTTP redirects.
  • CVE-2026-73117 (low): Applications that set response headers or redirect targets from request data could allow header injection or open redirects.

The changes behind these fixes are listed by module below.

juneau-microservice-core​

  • DirectoryResource now resolves requested paths against the canonical form of its root directory. Requests that resolve outside the root (via .., absolute paths, or symlinks) are rejected with 403 Forbidden. Paths that do not exist inside the root still return 404 Not Found.

juneau-rest-client​

  • RestClient no longer replays credential headers (Authorization, Cookie, Set-Cookie, Proxy-Authorization, X-API-Key) when following a redirect to a different origin (scheme, host, or port) or from https to http. The headers are removed from the redirected request. The new class org.apache.juneau.rest.client.RedirectSecurity exposes the same origin and downgrade checks.

juneau-rest-server​

  • Added org.apache.juneau.http.RedactedHeaders, the default list of sensitive header names (Authorization, Cookie, Set-Cookie, Proxy-Authorization, X-API-Key). CallLogger now writes [REDACTED] instead of the value for these headers in logged requests and responses. Change the list with redactedHeaders(String...) and redactHeader(String) on the CallLogger builder.
  • Server error responses no longer expose internal exception detail by default. See Upgrade notes.
  • The maxInput limit is now also enforced on multipart/form-data requests. A request whose declared Content-Length exceeds it, or whose parsed parts exceed it in total, is rejected with 413 Payload Too Large. The request content reader buffer is also capped at maxInput instead of the declared Content-Length.
  • The content URL parameter override (allowed unless disableContentParam is set) now applies only to PUT and POST requests.
  • RestResponse now strips invalid characters (such as control characters) from header values by default. This was previously opt-in through setSafeHeaders(). Use the new setUnsafeHeaders() to turn it off.
  • New RestResponse.sendSafeRedirect(String,String...) redirects only to a relative path or to one of the host names you pass in; otherwise it throws BadRequest. Use it instead of sendRedirect() when the target comes from request input. sendRedirect() itself is unchanged.
  • HTML document templates (BasicHtmlDocTemplate) now XML-escape SVL variable substitutions. See Upgrade notes.

juneau-marshall​

  • Parsers now limit lengths declared in the input. MessagePack binary and string lengths above 16M (16 MiB) are rejected with an IOException instead of allocating a buffer of that size. Lengths that are negative, or larger than the maximum int value, are also rejected. A parser that runs out of memory now throws a ParseException instead of an OutOfMemoryError.
  • ClassSwap no longer runs static initializers when resolving a class name during parsing.
  • XmlReader now always disables DTD processing and external DTD/schema access, including when validating is turned on. XML input that contains a DOCTYPE declaration is no longer processed as a DTD.

Upgrade notes​

Several of the fixes above change default behavior. Check these when upgrading from 9.2.0.

  • Request size limit. The default maximum request input size (RestContext maxInput) is now 1M, down from 100M, and it now also applies to multipart/form-data requests. Applications that accept larger request bodies must raise it, using @Rest(maxInput) or the RestContext.maxInput environment/system property.
  • Error responses. When stack-trace rendering is off (the default), the Thrown response header is no longer set, and the plain-text error body contains only the message of exceptions your code threw as a BasicHttpException (with <, >, and & replaced by spaces). The body is empty for all other exceptions. Clients that parse exception detail from error responses need @Rest(renderResponseStackTraces="true"). RRPC (remote proxy) endpoints are unchanged because their client proxy depends on that detail.
  • HTML templates. BasicHtmlDocTemplate now XML-escapes SVL variable substitutions in the aside, header, footer, nav, head, and no-results sections. Literal template text is unchanged, and the $W, $C, and $RS variables are still inserted as raw HTML. Request-data variables ($RQ, $RH, $RF, $RP, $RA, $SA, $R) are no longer resolved inside script and style sections. Templates that relied on request values containing HTML markup will now see them escaped.