GitHub Advisoryadvisory · Maven

GHSA-2hfh-9h53-qc24 Apache Neethi does not properly detect circular references in policy definitions.

HIGH Published 2026-05-01 Modified 2026-05-07 Official page ↗
Aliases
CVE-2026-42403
Ecosystem
Maven
Packages
org.apache.neethi:neethi
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2026-05-07

Affected packages

• Maven org.apache.neethi:neethi: < 3.2.2 → fixed in 3.2.2

Description

Apache Neethi does not properly detect circular references in policy definitions. When a WS-Policy document contains circular policy references (where Policy A references Policy B which references Policy A), the policy normalization process can enter an infinite loop or cause excessive recursion, leading to a stack overflow or application hang. An attacker can craft malicious policy documents with circular references to cause a Denial of Service condition Users are recommended to upgrade to version 3.2.2, which fixes this issue.

Related

Alias · CVE (1)

  • CVE-2026-42403 Apache Neethi does not properly detect circular references in policy definitions. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References