The Apache Juneau REST server mistakenly includes the internal exception class name and detailed error message in a "Thrown" response header on every error condition, and can also embed sensitive exception details within the error body even when stack‑trace rendering is disabled. This exposure reveals implementation details that could help an attacker identify vulnerable components, craft more targeted attacks or infer proprietary logic. The flaw is a pure information‑disclosure issue that does not allow direct exploitation but enables a richer attack surface for subsequent attacks.

Apache Juneau versions through 9.2.0, distributed by the Apache Software Foundation. No other vendors or product variants are listed as affected.

The CVSS score of 10 classifies this as a critical vulnerability. Although no EPSS score is available and the issue is not listed in the CISA KEV catalog, the straightforward remote discovery via standard HTTP error responses and the severity of the disclosed information make it a high‑risk exposure. An attacker can trigger arbitrary error conditions, read the sensitive header and body contents, and use that data to inform further exploitation attempts.