# CVE-2026-66144: Apache Neethi denial of service in remote policy retrieval

Source: https://junglewise.ai/threats/cve-2026-66144-apache-neethi-denial-of-service-in-remote-policy-retrieval  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-24. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-66144 · Severity: info · CVSS 0 · Published 2026-07-24

Apache Neethi, a library used for managing WS-Policy in Java applications, is vulnerable to a denial of service. If an application manually retrieves a remote policy via the API, an attacker could provide an excessively large policy file that consumes all available system resources. This could lead to application crashes or significant performance degradation, impacting service availability.

Technologies: [Apache Software Foundation Neethi](https://junglewise.ai/threats/technologies/neethi). Vendors: [Apache Software Foundation](https://junglewise.ai/threats/vendors/apache-software-foundation).

## Quick answers

**Is CVE-2026-66144 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66144 being exploited in the wild.

**How severe is CVE-2026-66144?** Informational severity, with a CVSS score of 0, published 24 July 2026.

**Which products and versions are affected?** Apache Software Foundation Neethi versions before 3.2.3.

**Is there a fix for CVE-2026-66144?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-66144 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-66144?** Check whether you run Apache Software Foundation Neethi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Apache Neethi versions prior to 3.2.3 are vulnerable to a denial of service (DoS) attack classified under CWE-400 (Uncontrolled Resource Consumption). While remote policy references are not automatically retrieved during normalization, manual retrieval via the API lacks size constraints. An attacker can exploit this by providing a link to a 'huge' policy file, leading to resource exhaustion when the library attempts to process it. The vulnerability is resolved in version 3.2.3 by implementing a default maximum size limit on data read from remote policy references.

## Affected products

- Apache Software Foundation Apache Neethi versions before 3.2.3

## Timeline

- 2026-07-24: disclosed
- 2026-07-24: advisory

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://lists.apache.org/thread/80xwwbhkqvbwkkmco6yl6fr5xkpdysjf](https://lists.apache.org/thread/80xwwbhkqvbwkkmco6yl6fr5xkpdysjf)

## Related threats

- [Apache Neethi denial of service via policy normalization bypass](https://junglewise.ai/threats/cve-2026-66143-apache-neethi-denial-of-service-via-policy-normalization-bypass)
- [Apache Neethi denial of service via uncontrolled recursion in policy parsing](https://junglewise.ai/threats/cve-2026-66142-apache-neethi-denial-of-service-via-uncontrolled-recursion-in)