CVEFinder.io

CVE-2026-42403

⚠️ high
🔍 Scan for this CVE
Summary

Apache Neethi does not properly detect circular references in policy definitions. When a WS-Policy document contains circular policy references (where Policy A references Policy B which references Policy A), the policy normalization process can enter an infinite loop or cause excessive recursion, leading to a stack overflow or application hang. An attacker can craft malicious policy documents with circular references to cause a Denial of Service condition Users are recommended to upgrade to ver

Description

Apache Neethi does not properly detect circular references in policy definitions. When a WS-Policy document contains circular policy references (where Policy A references Policy B which references Policy A), the policy normalization process can enter an infinite loop or cause excessive recursion, leading to a stack overflow or application hang. An attacker can craft malicious policy documents with circular references to cause a Denial of Service condition

Users are recommended to upgrade to version 3.2.2, which fixes this issue.

CVSS Score
7.5
High
EPSS Score
0.0
Exploit Probability
Published Date
2026-05-01
First Seen: 2026-05-03
📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 68.5% of all 340,405 vulnerabilities in our database.

#107,108
Above average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: May 1, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
YES
Can be exploited automatically
💥 Technical Impact
Partial
Limited system impact
SSVC data provided by CISA
Last Modified 2026-05-01
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE IDs (Weakness Types)
CWE-400

📦 Affected Products 1

Vendor Product Status Affected Versions
apache neethi Affected
< 3.2.2

🔗 References 2

https://lists.apache.org/thread/zm6t8skkkskjwk1881l4...
Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/05/01/7
Mailing List Third Party Advisory

🔗 Related CVEs 5

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-66142 ⚠️ high 7.5 0.5 Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested s... 2026-07-24
CVE-2026-66143 ⚠️ high 7.5 0.5 It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.... 2026-07-24
CVE-2026-66144 ⚠️ high 7.5 0.5 Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the ... 2026-07-24
CVE-2026-42402 ⚠️ high 7.5 0.0 Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalization. Specia... 2026-05-01
CVE-2026-42404 🔶 medium 6.5 0.0 Apache Neethi does not impose any restrictions on URIs when manually fetching remote policy references through the Polic... 2026-05-01
These CVEs affect the same products