PT-2026-36309 · Apache · Apache Neethi

Colm O Heigeartaigh · Published 2026-05-01 · Updated 2026-05-02 · CVE-2026-42402

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Neethi versions prior to 3.2.2

Description An issue exists in policy normalization where algorithmic complexity allows for a Denial of Service attack. Specially crafted WS-Policy documents can trigger an exponential Cartesian cross-product expansion during the normalization process. This results in unbounded memory allocation that exhausts the JVM heap because the process generates an excessive number of policy alternatives without limits.

Recommendations Upgrade to version 3.2.2.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-42402

GHSA-G36M-9G3M-2VMP

Affected Products

Apache Neethi

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-42402 · Security Note
• https://lists.apache.org/thread/p826j0phhmr9f83wzpmys1y0bdfrr2q4 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g36m-9g3m-2vmp · Vendor Advisory
• https://github.com/apache/ws-neethi · Note
• https://twitter.com/oss_security/status/2050588244929028298 · Twitter Post
• https://t.me/CVEtracker/52397 · Telegram Post
• https://t.me/cveNotify/161701 · Telegram Post
• http://openwall.com/lists/oss-security/2026/05/01/6 · Note
• https://twitter.com/KaitanSecurity/status/2050145713061802238 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2050171892783288603 · Twitter Post