CVE-2026-66144 — Apache Neethi: Remote PolicyReference fetch lacks resource bounds

Description (CNA)

Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the API it can cause a denial of service attack if a huge policy is retrieved. Users are recommended to upgrade to version 3.2.3, which fixes this issue by imposing a default maximum size on data read from remote policy references.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Neethi	affected 0 before 3.2.3

CWE

CWE-400

References

https://lists.apache.org/thread/80xwwbhkqvbwkkmco6yl6fr5xkpdysjf

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/07/24/10

CISA-ADP

No English description supplied.

No references supplied.