Junglewise Threat Intelligence

CVE-2026-42403: Apache Neethi does not properly detect circular references in policy definitions.

CVE-2026-42403 · Severity: low · CVSS 3.1 · Published 2026-05-01

Technologies: org.apache.neethi:neethi (Maven). Vendors: Maven.

Executive brief

Apache Neethi does not properly detect circular references in policy definitions.

Affected products

Maven org.apache.neethi:neethi

Related threats

Apache Neethi doesn't impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API
Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalization