PT-2026-36310 · Apache · Apache Neethi

Colm O Heigeartaigh · Published 2026-05-01 · Updated 2026-05-02 · CVE-2026-42403

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Neethi versions prior to 3.2.2

Description Apache Neethi fails to properly detect circular references in policy definitions. When a WS-Policy document contains circular policy references (for example, Policy A references Policy B, which in turn references Policy A), the policy normalization process may enter an infinite loop or cause excessive recursion. This can result in a stack overflow or an application hang, allowing an attacker to cause a Denial of Service condition by crafting malicious policy documents.

Recommendations Upgrade to version 3.2.2.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-42403

GHSA-2HFH-9H53-QC24

Affected Products

Apache Neethi

References · 10

• https://osv.dev/vulnerability/GHSA-2hfh-9h53-qc24 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42403 · Security Note
• https://lists.apache.org/thread/zm6t8skkkskjwk1881l4m4n0l7dqclzo · Vendor Advisory
• https://github.com/apache/ws-neethi · Note
• https://twitter.com/VulmonFeeds/status/2050169332953383300 · Twitter Post
• https://twitter.com/KaitanSecurity/status/2050145722683543952 · Twitter Post
• http://openwall.com/lists/oss-security/2026/05/01/7 · Note
• https://t.me/CVEtracker/52398 · Telegram Post
• https://twitter.com/oss_security/status/2050588244929028298 · Twitter Post
• https://t.me/cveNotify/161702 · Telegram Post