Neethi (Apache) - vulnerabilities (CVEs)
11 CVEs, 0 in the last 30 days, 22 known versions, newest CVE from 2026-09-21. Vendor: Apache.
CVEs of Neethi
- CVE-2026-91867 - CVSS 4.3 (medium), 2026-09-21: When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slowly can keep the…
- CVE-2026-91866 - CVSS 7.5 (high), 2026-09-21: A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU for a long time…
- CVE-2026-91865 - CVSS 7.5 (high), 2026-09-21: A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming…
- CVE-2026-91864 - CVSS 7.5 (high), 2026-09-21: A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its…
- CVE-2026-91863 - CVSS 7.5 (high), 2026-09-21: A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread stack, crashing the…
- CVE-2026-66144 - CVSS 7.5 (high), 2026-07-24: Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the API it can cause a denial of service…
- CVE-2026-66143 - CVSS 7.5 (high), 2026-07-24: It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain crafted policies, which…
- CVE-2026-66142 - CVSS 7.5 (high), 2026-07-24: Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to a denial…
- CVE-2026-42404 - CVSS 7.2 (high), 2026-05-01: Apache Neethi does not impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API. When an application…
- CVE-2026-42403 - CVSS 7.5 (high), 2026-05-01: Apache Neethi does not properly detect circular references in policy definitions. When a WS-Policy document contains circular policy references (where Policy…
- CVE-2026-42402 - CVSS 7.5 (high), 2026-05-01: Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalization. Specially crafted WS-Policy documents can…
