PT-2026-64288 · Apache · Apache Neethi

CVE-2026-66142 · Publicado 2026-07-24 · Atualizado 2026-07-24

NVD

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to a denial of service attack when parsing policies due to runtime memory exhaustion. Users are recommended to upgrade to version 3.2.3, which fixes this issue.

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

CVE-2026-66142

Produtos afetados

Apache Neethi

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-66142 · Nota de Segurança
• http://openwall.com/lists/oss-security/2026/07/24/8 · Nota
• https://lists.apache.org/thread/fomwtwt4pzzhxn4fyn3skykto913vfzt · Aviso do Fabricante