Apache Neethi
Approved changes feed: RSS · Atom
cpe:2.3:a:apache_software_foundation:apache_neethi:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Apache Software Foundation (f563070d-e18f-561b-b86c-987936937e8a) |
|---|---|
| Product | Apache Neethi (f6e349d0-920c-5c5a-9a26-950408283765) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-91866 |
vulnerable | 2026-10-13 12:28:43.792456 |
Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of service
A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU for a long time (denial of service).
Users are recommended to upgrade to version 3.2.4, which fixes this issue.
Published: 2026-09-21T11:27:15.767Z
Updated: 2026-09-21T13:17:25.639Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-91867 |
vulnerable | 2026-10-13 12:28:43.716036 |
Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitely
When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slowly can keep the fetch alive indefinitely and tie up the calling thread (denial of service).
Users are recommended to upgrade to version 3.2.4, which fixes this issue.
Published: 2026-09-21T11:27:45.131Z
Updated: 2026-09-21T13:15:19.316Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-91863 |
vulnerable | 2026-10-13 12:28:43.706681 |
Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service
A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread stack, crashing the parser (denial of service).
Users are recommended to upgrade to version 3.2.4, which fixes this issue.
Published: 2026-09-21T11:25:26.648Z
Updated: 2026-09-21T13:36:42.505Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-91865 |
vulnerable | 2026-10-13 12:28:43.648957 |
Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service
A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory (denial of service).
Users are recommended to upgrade to version 3.2.4, which fixes this issue.
Published: 2026-09-21T11:26:52.788Z
Updated: 2026-09-21T13:17:03.972Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-91864 |
vulnerable | 2026-10-13 12:28:43.618646 |
Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustion
A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its size limits, exhausting the heap (denial of service).
Users are recommended to upgrade to version 3.2.4, which fixes this issue.
Published: 2026-09-21T11:26:20.054Z
Updated: 2026-09-21T13:27:39.838Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-66144 |
vulnerable | 2026-07-29 01:06:20.304770 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-66143 |
vulnerable | 2026-07-29 01:06:20.304528 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-66142 |
vulnerable | 2026-07-29 01:06:20.304219 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42404 |
vulnerable | 2026-06-08 08:03:16.282343 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42403 |
vulnerable | 2026-06-08 08:03:16.281778 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42402 |
vulnerable | 2026-06-08 08:03:16.280602 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.