CVE-2026-66144

⚠️ high

Summary

Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the API it can cause a denial of service attack if a huge policy is retrieved. Users are recommended to upgrade to version 3.2.3, which fixes this issue by imposing a default maximum size on data read from remote policy references.

CVSS Score

7.5

High

EPSS Score

0.5

Exploit Probability

Published Date

2026-07-24

First Seen: 2026-07-31

📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 68.5% of all 340,405 vulnerabilities in our database.

#107,108

Above average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: Jul 24, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

YES

Can be exploited automatically

💥 Technical Impact

Partial

Limited system impact

🏆 Discovered By

Reported by LTSHFWJT

SSVC data provided by CISA

Last Modified 2026-07-27

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE IDs (Weakness Types)

CWE-400

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
apache	neethi	Affected	< 3.2.3

🔗 References 2

https://lists.apache.org/thread/80xwwbhkqvbwkkmco6yl...

Mailing List Vendor Advisory

http://www.openwall.com/lists/oss-security/2026/07/2...

Mailing List Third Party Advisory

🔗 Related CVEs 5

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-66142	⚠️ high	7.5	0.5	Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested s...	2026-07-24
CVE-2026-66143	⚠️ high	7.5	0.5	It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2....	2026-07-24
CVE-2026-42402	⚠️ high	7.5	0.0	Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalization. Specia...	2026-05-01
CVE-2026-42403	⚠️ high	7.5	0.0	Apache Neethi does not properly detect circular references in policy definitions. When a WS-Policy document contains cir...	2026-05-01
CVE-2026-42404	🔶 medium	6.5	0.0	Apache Neethi does not impose any restrictions on URIs when manually fetching remote policy references through the Polic...	2026-05-01

These CVEs affect the same products