Apache Neethi up to 3.2.1 resource consumption

Summaryinfo

A vulnerability labeled as problematic has been found in Apache Neethi up to 3.2.1. This affects an unknown part. Executing a manipulation can lead to resource consumption. This vulnerability appears as CVE-2026-42403. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Apache Neethi up to 3.2.1. It has been declared as problematic. This vulnerability affects an unknown part. The manipulation with an unknown input leads to a resource consumption vulnerability. The CWE definition for the vulnerability is CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. As an impact it is known to affect availability. CVE summarizes:

Apache Neethi does not properly detect circular references in policy definitions. When a WS-Policy document contains circular policy references (where Policy A references Policy B which references Policy A), the policy normalization process can enter an infinite loop or cause excessive recursion, leading to a stack overflow or application hang. An attacker can craft malicious policy documents with circular references to cause a Denial of Service condition Users are recommended to upgrade to version 3.2.2, which fixes this issue.

The advisory is available at lists.apache.org. This vulnerability was named CVE-2026-42403 since 04/27/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 06/24/2026). This vulnerability is assigned to T1499 by the MITRE ATT&CK project.

Upgrading to version 3.2.2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-2050). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Affected

• IBM WebSphere Application Server Liberty
• IBM WebSphere Application Server

Productinfo

Vendor

• Apache

Name

• Neethi

Version

• 3.2.0
• 3.2.1

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion