Skip to content
fr Sign in
6.5 Medium

CVE-2026-42404 Apache Neethi does not impose any restrictions on URIs when manually fetching remote policy references through the…

Description

Apache Neethi does not impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API. When an application explicitly calls the API to retrieve a policy from a remote URI, an outbound request is made for arbitrary protocols and internal IP adddresses. From 3.2.2, only http or https URIs are allowed, and link-local/multicast/any-local addresses are forbidden. Users are recommended to upgrade to version 3.2.2, which fixes this issue.

Affected products and versions

Product Affected versions Fixed in
Apache Neethi 3.2 earliest → < 3.2.2 3.2.2

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Apache Neethi

The 11 CVEs of Apache Neethi →
CVE-2026-91867 When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server… Not rated CVE-2026-91866 A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of… Not rated CVE-2026-91865 A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references… Not rated CVE-2026-91864 A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into… Not rated
Track this CVE