Resource exhaustion in Apache Neethi - CVE-2026-66143

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU144745

Resource exhaustion in Apache Neethi - CVE-2026-66143

Published: August 24, 2026


Vulnerability identifier: #VU144745
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-66143
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource management in policy normalization when processing crafted policies. A remote attacker can supply a specially crafted policy to cause a denial of service.

The issue arises because the maximum number of normalized policy alternatives can be bypassed across policy computation paths.


Affected software

Apache Neethi
Rational Test Virtualization Server
Enterprise Application Runtimes
Cloud Pak for Applications
DevOps Test Integrations and APIs
DevOps Test Virtualization
IBM App Connect for Healthcare
IBM App Connect Enterprise

How to mitigate CVE-2026-66143

Install security update from vendor's website.

Apache Neethi - update to 3.2.3
DevOps Test Integrations and APIs - update to 12.0.0
DevOps Test Virtualization - update to 12.0.0
IBM App Connect Enterprise - update to 13.0.8.2

External References

Related Security Bulletins