Apache Software Foundation Apache Neethi
11 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-91867 | < 3.2.4 | Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitely | MEDIUM 4.3 | 0.5 % | ||
| CVE-2026-91866 | < 3.2.4 | Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of service | HIGH 7.5 | 0.7 % | ||
| CVE-2026-91865 | < 3.2.4 | Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service | HIGH 7.5 | 0.7 % | ||
| CVE-2026-91864 | < 3.2.4 | Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustion | HIGH 7.5 | 0.7 % | ||
| CVE-2026-91863 | < 3.2.4 | Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service | HIGH 7.5 | 0.8 % | ||
| CVE-2026-66144 | < 3.2.3 | Apache Neethi: Remote PolicyReference fetch lacks resource bounds | HIGH 7.5 | 0.7 % | ||
| CVE-2026-66143 | < 3.2.3 | Apache Neethi: Missing global alternative-output budget across policy computation paths | HIGH 7.5 | 0.9 % | ||
| CVE-2026-66142 | < 3.2.3 | Apache Neethi: Uncontrolled recursion in policy processing | HIGH 7.5 | 0.7 % | ||
| CVE-2026-42404 | < 3.2.2 | Apache Neethi: Unrestricted HTTP Redirect Following in Policy References | HIGH 7.2 | 0.5 % | ||
| CVE-2026-42402 | < 3.2.2 | Apache Neethi: Policy Normalization Unbounded Resource Allocation DoS | HIGH 7.5 | 0.7 % | ||
| CVE-2026-42403 | < 3.2.2 | Apache Neethi: Circular Policy Reference Infinite Loop | HIGH 7.5 | 0.8 % |