| CVE-2026-91867 |
When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server…
|
Not rated
|
Sep 21, 2026 |
| CVE-2026-91866 |
A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of…
|
Not rated
|
Sep 21, 2026 |
| CVE-2026-91865 |
A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references…
|
Not rated
|
Sep 21, 2026 |
| CVE-2026-91864 |
A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into…
|
Not rated
|
Sep 21, 2026 |
| CVE-2026-91863 |
A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and…
|
Not rated
|
Sep 21, 2026 |
| CVE-2026-66144 |
Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via…
|
Not rated
|
Jul 24, 2026 |
| CVE-2026-66143 |
It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2…
|
Not rated
|
Jul 24, 2026 |
| CVE-2026-66142 |
Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested…
|
Not rated
|
Jul 24, 2026 |
| CVE-2026-42404 |
Apache Neethi does not impose any restrictions on URIs when manually fetching remote policy references through the…
|
6.5
Medium
|
May 1, 2026 |
| CVE-2026-42402 |
Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalization
|
7.5
High
|
May 1, 2026 |
| CVE-2026-42403 |
Apache Neethi does not properly detect circular references in policy definitions
|
7.5
High
|
May 1, 2026 |