- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 11 · 9 high, 2 medium
- Dependents
- 354
- Registry
- Maven Central
Advisories 11
- CVE-2026-91867Medium 4.3
Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitely
Affected: fixed in 3.2.4.
- CVE-2026-91866High 7.5
Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of service
Affected: fixed in 3.2.4.
- CVE-2026-91865High 7.5
Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service
Affected: fixed in 3.2.4.
- CVE-2026-91864High 7.5
Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustion
Affected: fixed in 3.2.4.
- CVE-2026-91863High 7.5
Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service
Affected: fixed in 3.2.4.
- CVE-2026-66144High 7.5
Apache Neethi: Remote PolicyReference fetch lacks resource bounds
Affected: fixed in 3.2.3.
- CVE-2026-66143High 7.5
Apache Neethi: Missing global alternative-output budget across policy computation paths
Affected: fixed in 3.2.3.
- CVE-2026-66142High 7.5
Apache Neethi: Uncontrolled recursion in policy processing
Affected: fixed in 3.2.3.
- CVE-2026-42404Medium 6.5
Apache Neethi: Unrestricted HTTP Redirect Following in Policy References
Affected: fixed in 3.2.2; fixed in 3.2.2.
- CVE-2026-42402High 7.5
Apache Neethi: Policy Normalization Unbounded Resource Allocation DoS
Affected: fixed in 3.2.2; fixed in 3.2.2.
- CVE-2026-42403High 7.5
Apache Neethi: Circular Policy Reference Infinite Loop
Affected: fixed in 3.2.2; fixed in 3.2.2.