# CVE-2026-66142: Apache Neethi denial of service via uncontrolled recursion in policy parsing

Source: https://junglewise.ai/threats/cve-2026-66142-apache-neethi-denial-of-service-via-uncontrolled-recursion-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-24. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-66142 · Severity: info · CVSS 7.5 · Published 2026-07-24

Apache Neethi, a library used for managing Web Services policies, is vulnerable to a flaw that can crash applications. By sending a specially crafted policy with deeply nested structures or missing identifiers, an attacker can cause the system to run out of memory. This results in a denial-of-service, making the affected service unavailable to legitimate users.

Technologies: [Apache Software Foundation Neethi](https://junglewise.ai/threats/technologies/neethi). Vendors: [Apache Software Foundation](https://junglewise.ai/threats/vendors/apache-software-foundation).

## Quick answers

**Is CVE-2026-66142 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66142 being exploited in the wild.

**How severe is CVE-2026-66142?** Informational severity, with a CVSS score of 7.5, published 24 July 2026.

**Which products and versions are affected?** Apache Software Foundation Neethi versions prior to 3.2.3.

**Is there a fix for CVE-2026-66142?** A patch was published on 2026-07-24: Version 3.2.3 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-66142 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-66142?** Check whether you run Apache Software Foundation Neethi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack exhaustion or uncontrolled recursion vulnerability exists in Apache Neethi's policy parsing logic. When the library processes a WS-Policy that is either deeply nested or lacks mandatory Policy IDs, it enters a recursive loop that consumes excessive system memory. This is a remote, unauthenticated attack vector that allows an attacker to trigger a Denial of Service (DoS) by providing a malicious policy file to any application utilizing the Neethi library for parsing. The issue is resolved in version 3.2.3.

## Affected products

- Apache Software Foundation Neethi versions prior to 3.2.3

## Timeline

- 2026-07-24: advisory: NVD publication date
- 2026-07-24: patched: Version 3.2.3 released to address the issue

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://lists.apache.org/thread/fomwtwt4pzzhxn4fyn3skykto913vfzt](https://lists.apache.org/thread/fomwtwt4pzzhxn4fyn3skykto913vfzt)

## Related threats

- [Apache Neethi denial of service in remote policy retrieval](https://junglewise.ai/threats/cve-2026-66144-apache-neethi-denial-of-service-in-remote-policy-retrieval)
- [Apache Neethi denial of service via policy normalization bypass](https://junglewise.ai/threats/cve-2026-66143-apache-neethi-denial-of-service-via-policy-normalization-bypass)