CVE-2026-66142 — Apache Neethi: Uncontrolled recursion in policy processing

CVE-2026-66142

Apache Neethi: Uncontrolled recursion in policy processing PUBLISHED

Description (CNA)

Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to a denial of service attack when parsing policies due to runtime memory exhaustion. Users are recommended to upgrade to version 3.2.3, which fixes this issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Neethi	affected 0 before 3.2.3

CWE

CWE-400

References

https://lists.apache.org/thread/fomwtwt4pzzhxn4fyn3skykto913vfzt

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/07/24/8

CISA-ADP

No English description supplied.

No references supplied.