Skip to content
fr Sign in
7.5 High

CVE-2026-42403 Apache Neethi does not properly detect circular references in policy definitions

Description

Apache Neethi does not properly detect circular references in policy definitions. When a WS-Policy document contains circular policy references (where Policy A references Policy B which references Policy A), the policy normalization process can enter an infinite loop or cause excessive recursion, leading to a stack overflow or application hang. An attacker can craft malicious policy documents with circular references to cause a Denial of Service condition Users are recommended to upgrade to version 3.2.2, which fixes this issue.

Affected products and versions

Product Affected versions Fixed in
Apache Neethi 3.2 earliest → < 3.2.2 3.2.2

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Apache Neethi

The 11 CVEs of Apache Neethi →
CVE-2026-91867 When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server… Not rated CVE-2026-91866 A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of… Not rated CVE-2026-91865 A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references… Not rated CVE-2026-91864 A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into… Not rated
Track this CVE