SB2026082598 - Multiple vulnerabilities in Apache Neethi

Description

This security bulletin contains information about 3 vulnerabilities.

1) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-42402)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to unbounded resource allocation in policy normalization when parsing specially crafted WS-Policy documents. A remote attacker can send a specially crafted WS-Policy document to cause a denial of service.

The issue can exhaust the JVM heap during normalization because an exponential Cartesian cross-product expansion generates an excessive number of policy alternatives.

2) Input validation error (CVE-ID: CVE-2026-42403)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the policy normalization process when parsing WS-Policy documents containing circular policy references. A remote attacker can supply a specially crafted policy document to cause a denial of service.

The issue can result in an infinite loop, excessive recursion, a stack overflow, or an application hang.

3) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-42404)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to access internal network resources.

The vulnerability exists due to improper input validation in the PolicyReference API when fetching remote policy references from user-supplied URIs. A remote attacker can supply a crafted URI to access internal network resources.

Exploitation requires an application to explicitly call the API to retrieve a policy from a remote URI.

Remediation

Install update from vendor's website.

References

• https://lists.apache.org/api/email.lua?id=xq8ow9jmjrr6rfqmsk1bk9hfzvwjrpm1
• https://ws.apache.org/neethi/security.html
• https://lists.apache.org/api/email.lua?id=5j4c7l4ombvfpctk53wqmbw1v2ctvzs7
• https://lists.apache.org/api/email.lua?id=nsqbqbks9wgw098235hxzz4sg0gzxdk3