High [CVE-2026-66143] It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2
This high-severity Apache Software Foundation advisory covers CVE-2026-66143 affecting Apache Neethi.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Get an email when Apache Software Foundation publishes the next one.
VulniPulse checks Apache Software Foundation's security advisories around the clock and emails you new ones with the severity, the fixed version and the vendor's link. First month free, then US$15/month; we email you before the first charge.
Summary
It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain crafted policies, which may lead to a denial of service attack via resource consumption. Users are recommended to upgrade to version 3.2.3, which fixes this issue.
- Apache Neethi before 3.2.3
Official advisory · high-confidence parse· fetched 3 months ago·verify at source
Mitigation checklist
- Users are recommended to upgrade to version 3.2.3, which fixes this issue.
Official advisory · high-confidence parse· fetched 3 months ago·verify at source
More Apache Software Foundation advisories
- CVE-2026-91867Sep 21, 2026When Neethi fetches a remote policy reference, it only limits the time per read, not
- CVE-2026-91866Sep 21, 2026specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do
- CVE-2026-91865Sep 21, 2026small WS-Policy document using repeated policy references can force Neethi to re-expand
- CVE-2026-91864Sep 21, 2026specially crafted WS-Policy document can pack unlimited content inside a policy assertion
- CVE-2026-91863Sep 21, 2026specially crafted WS-Policy document with deeply nested policy elements can bypass
- CVE-2026-66142Jul 24, 2026Apache Neethi is vulnerable to uncontrolled recursion
Android app · Google Play
Monitor future Apache Software Foundation CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.