CVE-2026-91867
Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitely
MEDIUM 4.3
En bref
- Source
- NVD
- EPSS
- EPSS 0.50 % · centile 42 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- apache
- Statut NVD
- Analyzed
Description
When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slowly can keep the fetch alive indefinitely and tie up the calling thread (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.
Faiblesses (CWE)
- CWE-400 — Consommation de ressources non maîtrisée (déni de service)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L | CISA-ADP |
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2026-83889
- GCVE · GCVE-0-2026-91867
Configurations affectées (CPE NVD)
cpe:2.3:a:apache:neethi:*:*:*:*:*:*:*:*< 3.2.4
Produits affectés
| Produit | Versions |
|---|---|
| Apache Software Foundation · Apache Neethi | affected 0 < 3.2.4 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |