CVE-2026-42404

🔶 medium

Summary

Apache Neethi does not impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API. When an application explicitly calls the API to retrieve a policy from a remote URI, an outbound request is made for arbitrary protocols and internal IP adddresses. From 3.2.2, only http or https URIs are allowed, and link-local/multicast/any-local addresses are forbidden. Users are recommended to upgrade to version 3.2.2, which fixes this issue.

CVSS Score

6.5

Medium

EPSS Score

0.0

Exploit Probability

Published Date

2026-05-01

First Seen: 2026-05-03

📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 47.4% of all 340,405 vulnerabilities in our database.

#179,012

Below average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: May 1, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

YES

Can be exploited automatically

💥 Technical Impact

Partial

Limited system impact

SSVC data provided by CISA

Last Modified 2026-05-01

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE IDs (Weakness Types)

CWE-918

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
apache	neethi	Affected	< 3.2.2

🔗 References 2

https://lists.apache.org/thread/zdspnt64zznyjyn64855...

Issue Tracking Vendor Advisory

http://www.openwall.com/lists/oss-security/2026/05/01/8

Mailing List Third Party Advisory

🔗 Related CVEs 5

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-66142	⚠️ high	7.5	0.5	Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested s...	2026-07-24
CVE-2026-66143	⚠️ high	7.5	0.5	It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2....	2026-07-24
CVE-2026-66144	⚠️ high	7.5	0.5	Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the ...	2026-07-24
CVE-2026-42402	⚠️ high	7.5	0.0	Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalization. Specia...	2026-05-01
CVE-2026-42403	⚠️ high	7.5	0.0	Apache Neethi does not properly detect circular references in policy definitions. When a WS-Policy document contains cir...	2026-05-01

These CVEs affect the same products