BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more
← CVE Radar

CVE-2026-73099Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body override

Cross-Site Request Forgery (CSRF) vulnerability in Apache Juneau. The REST server accepts a "content" query parameter that replaces the request body, and this is enabled by default on every HTTP method, including GET. A cross-site link can therefore deliver an attacker-chosen request body to an endpoint without a CORS preflight, defeating protections that rely on the HTTP method or content type instead of an anti-CSRF token. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue. Applications that do not use the content parameter can also set disableContentParam to true.

10.0 CRITICALEPSS 0.21%Not in KEVNVD: Deferred

OverviewAffected ProductsReferences
NVD CVE.org

Overview

Severity

ScoreSeverityVersionVector String
10.0CRITICAL4.0apache (CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Details

CVE ID
CVE-2026-73099
Status
Deferred
Assigner (CNA)
apache
Published
Nov 5, 2026
Last modified
2026-11-05 19:17 UTC
Weaknesses
  • CWE-352 · Cross-Site Request Forgery (CSRF)

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 08:26 UTC.