{"metadata": {"vulnerability": "CVE-2026-73117", "count": 14, "kinds": {"milestone": 4, "sighting": 5, "kev": 0, "other": 5}}, "data": [{"timestamp": "2026-08-10T21:16:08.533Z", "date_only": false, "value": "2026-08-10T21:16:08.533Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-73117", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-05T11:54:11.703Z", "date_only": false, "value": "2026-11-05T11:54:11.703Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-73117", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-05T11:54:11.703Z", "date_only": false, "value": "2026-11-05T11:54:11.703Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-73117", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-05T11:54:11.703Z", "date_only": false, "value": "2026-11-05T11:54:11.703Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / apache", "record": "CVE-2026-73117", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-05T12:00:14.644Z", "date_only": false, "value": "2026-11-05T12:00:14.644469Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117563720592059830", "record": "CVE-2026-73117", "field": "creation_timestamp", "uuid": "2dc73f0d-96e1-4ae7-9b3d-1fe9b47c0388", "content": "CVE-2026-73117 Apache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request data Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability in Apache Juneau.\nThe Apache Juneau REST server passed response header values and redirect targets to the servlet container unchecked. An application that sets a response header or redirect target from request data could let a remote client inject header lines (where the servlet container does not itself reject CR/LF) or redirect users to an arbitrary external site. The framework itself does not build headers or redirects from request data; exposure depends on application code.\nThis issue affects Apache Juneau: through 9.2.0.\nUsers are recommended to upgrade to version 9.2.1, which fixes the issue. Header values are now sanitized by default; applications that build redirect targets from request data must also switch from sendRedirect() to the new sendSafeRedirect().\nhttps://www.cve.org/CVERecord?id=CVE-2026-73117https://lists.apache.org/thread.html/j05q7vw08j48o96tdlzcsd4sozx1lyl6#apache #ApacheSoftwareFoundation #ApacheJuneau#CVE_2026_73117#bot", "url": "https://infosec.exchange/users/cve/statuses/117563720592059830"}, {"timestamp": "2026-11-05T12:17:51Z", "date_only": false, "value": "2026-11-05T12:17:51Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-RW79-JGJP-5W92", "record": "GHSA-RW79-JGJP-5W92", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-05T12:17:51.473Z", "date_only": false, "value": "2026-11-05T12:17:51.473", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-73117", "record": "FKIE_CVE-2026-73117", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-05T12:32:14Z", "date_only": false, "value": "2026-11-05T12:32:14Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-RW79-JGJP-5W92", "record": "GHSA-RW79-JGJP-5W92", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-05T12:32:14Z", "date_only": false, "value": "2026-11-05T12:32:14Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-RW79-JGJP-5W92", "record": "GHSA-RW79-JGJP-5W92", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-05T12:50:05.413Z", "date_only": false, "value": "2026-11-05T12:50:05.413944Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mzkvrodpko2t", "record": "CVE-2026-73117", "field": "creation_timestamp", "uuid": "7260ff48-4580-4f47-80e5-88810e505f64", "content": "CVE-2026-73117 - apache juneau\nApache Juneau versions up to 9.2.0 can pass data from a web request straight into response headers or redirect URLs. If an application uses request data for\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#apachejuneau #apachefoundation #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mzkvrodpko2t"}, {"timestamp": "2026-11-05T13:00:37.919Z", "date_only": false, "value": "2026-11-05T13:00:37.919102Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3mzkwei3ci2kg", "record": "CVE-2026-73117", "field": "creation_timestamp", "uuid": "ea8d1fca-ad80-4124-bf20-c0c021443cae", "content": "CVE Radar | CVE-2026-73117 | CVSS 10.0\n\nApache Juneau HTTP Response Splitting\n\nApache Juneau\u2019s REST server has an HTTP response-splitting weakness affecting releases through 9.2.0.\n\nFull analysis: https://t.me/aiutocomputerhelp_lab/1383", "url": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3mzkwei3ci2kg"}, {"timestamp": "2026-11-05T13:41:28.129Z", "date_only": false, "value": "2026-11-05T13:41:28.129195Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/2xydsew3aulx2", "record": "CVE-2026-73117", "field": "creation_timestamp", "uuid": "1a76794c-696a-48c0-b032-7ee7353611f0", "content": "CVE-2026-73117 - Apache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request data\nCVE ID : CVE-2026-73117\n \n Published : Nov. 5, 2026, 12:17 p.m. | 50\u00a0minutes ago\n \n Description : Improper Neutralization of CRL...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/2xydsew3aulx2"}, {"timestamp": "2026-11-05T14:08:05.228Z", "date_only": false, "value": "2026-11-05T14:08:05.228626Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mzl255dzfk2f", "record": "CVE-2026-73117", "field": "creation_timestamp", "uuid": "92541058-bcb4-417e-93d1-f97029f69f8d", "content": "\ud83d\udea8 CVE-2026-73117 \u2014 CVSS 10 CRITICAL\n\nImproper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability in Apac...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-73117\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mzl255dzfk2f"}, {"timestamp": "2026-11-05T15:01:29.553Z", "date_only": false, "value": "2026-11-05T15:01:29.553", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-73117", "record": "FKIE_CVE-2026-73117", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-08T10:12:50.424Z", "anchors": {"origin": {"timestamp": "2026-11-05T11:54:11.703Z", "date_only": false, "value": "2026-11-05T11:54:11.703Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-73117", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-05T11:54:11.703Z", "date_only": false, "value": "2026-11-05T11:54:11.703Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-73117", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 253118.721765, "hours": 70.31075604583333, "days": 2.9296148352430555, "min_seconds": 253118.721765, "max_seconds": 253118.721765, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-05T11:54:11.703Z", "date_only": false, "value": "2026-11-05T11:54:11.703Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-73117", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-08T10:12:50.424Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}