Junglewise Threat Intelligence

CVE-2026-42402: Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalization

CVE-2026-42402 · Severity: low · CVSS 3.1 · Published 2026-05-01

Technologies: org.apache.neethi:neethi (Maven). Vendors: Maven.

Executive brief

Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalization

Affected products

Maven org.apache.neethi:neethi

Related threats

Apache Neethi doesn't impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API
Apache Neethi does not properly detect circular references in policy definitions.