Aller au contenu
en Se connecter
7.5 Élevée

CVE-2026-42403 Apache Neethi does not properly detect circular references in policy definitions

Description

Apache Neethi does not properly detect circular references in policy definitions. When a WS-Policy document contains circular policy references (where Policy A references Policy B which references Policy A), the policy normalization process can enter an infinite loop or cause excessive recursion, leading to a stack overflow or application hang. An attacker can craft malicious policy documents with circular references to cause a Denial of Service condition Users are recommended to upgrade to version 3.2.2, which fixes this issue.

Produits et versions touchés

Produit Versions touchées Corrigé en
Apache Neethi 3.2 premières → < 3.2.2 3.2.2

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Apache Neethi

Les 11 CVE de Apache Neethi →
CVE-2026-91867 When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server… Non notée CVE-2026-91866 A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of… Non notée CVE-2026-91865 A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references… Non notée CVE-2026-91864 A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into… Non notée
Suivre cette CVE