CVE-2026-91867 — Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitely

CVE-2026-91867

Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitely PUBLISHED

Description (CNA)

When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slowly can keep the fetch alive indefinitely and tie up the calling thread (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Neethi	affected 0 before 3.2.4

CWE

No CWE identifiers supplied.

References

https://lists.apache.org/thread/dsr2ktf199mqhw2jtlbklyz7tzd86ycd

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/09/18/14

CISA-ADP

No English description supplied.

No references supplied.