Vulnerabilities

TI-2026-30703 CVE-2026-42404 · GHSA-287c-fxr7-3w6c

Apache Neethi: Unrestricted HTTP Redirect Following in Policy References

LOW 38

Apache Neethi does not impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00497 Published 2026-05-01 Partial fix · 3.2.2 CWE-918

TI-2026-30701 CVE-2026-42402 · GHSA-g36m-9g3m-2vmp

MEDIUM 40

Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalization.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00711 Published 2026-05-01 Partial fix · 3.2.2 CWE-400

TI-2026-30702 CVE-2026-42403 · GHSA-2hfh-9h53-qc24

MEDIUM 40

Apache Neethi does not properly detect circular references in policy definitions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00763 Published 2026-05-01 Partial fix · 3.2.2 CWE-400