Uncontrolled Recursion in Apache Neethi - CVE-2026-66142
Published: August 24, 2026
Vulnerability identifier: #VU144744
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-66142
CWE-ID: CWE-674
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in policy processing when parsing policies that lack policy ids or deeply nested policy structures. A remote attacker can supply a specially crafted policy to cause a denial of service.
Affected software
Apache Neethi
Rational Test Virtualization Server
Enterprise Application Runtimes
Cloud Pak for Applications
DevOps Test Integrations and APIs
DevOps Test Virtualization
IBM App Connect for Healthcare
IBM App Connect Enterprise
Rational Test Virtualization Server
Enterprise Application Runtimes
Cloud Pak for Applications
DevOps Test Integrations and APIs
DevOps Test Virtualization
IBM App Connect for Healthcare
IBM App Connect Enterprise
How to mitigate CVE-2026-66142
Install security update from vendor's website.
Apache Neethi - update to 3.2.3
DevOps Test Integrations and APIs - update to 12.0.0
DevOps Test Virtualization - update to 12.0.0
IBM App Connect Enterprise - update to 13.0.8.2
DevOps Test Integrations and APIs - update to 12.0.0
DevOps Test Virtualization - update to 12.0.0
IBM App Connect Enterprise - update to 13.0.8.2
External References
Related Security Bulletins
- Multiple vulnerabilities in Apache Neethi
- Multiple vulnerabilities in IBM App Connect Enterprise
- Multiple vulnerabilities in IBM Cloud Pak for Applications
- Multiple vulnerabilities in IBM Enterprise Application Runtimes
- Multiple vulnerabilities in App Connect for Healthcare
- Multiple vulnerabilities in IBM DevOps Test Virtualization/IBM DevOps Test Integrations and APIs