Apache Juneau’s MessagePack parser and REST request handling allocate buffers based solely on length values provided in the input. A malicious client can submit a tiny request that causes the parser to attempt a multi‑gigabyte allocation, triggering an OutOfMemoryError and a server crash. The vulnerability is rooted in lack of resource limits or throttling, classified as an unbounded allocation flaw.

The issue affects all versions of Apache Juneau up through 9.2.0 released by the Apache Software Foundation. Any deployment that relies on the default inclusion of the MessagePack parser or stores multipart uploads without resource limits is impacted.

The CVSS score of 8.7 indicates high severity, and the EPSS score is currently unavailable, so the projected exploitation likelihood remains unknown. The vulnerability is not yet listed in the CISA KEV catalog. An unauthenticated client can trigger the allocation by sending a few crafted bytes over the network, meaning the attack vector is remote and does not require privileged access.