Resource exhaustion in Apache Neethi - CVE-2026-66144
Published: August 24, 2026
Vulnerability identifier: #VU144746
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-66144
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to improper resource control in the remote PolicyReference retrieval API when manually retrieving remote policy references. A remote user can retrieve a huge remote policy to cause a denial of service.
Remote policy references are not retrieved during policy normalization.
Affected software
Apache Neethi
Rational Test Virtualization Server
Enterprise Application Runtimes
Cloud Pak for Applications
DevOps Test Integrations and APIs
DevOps Test Virtualization
IBM App Connect for Healthcare
IBM App Connect Enterprise
Rational Test Virtualization Server
Enterprise Application Runtimes
Cloud Pak for Applications
DevOps Test Integrations and APIs
DevOps Test Virtualization
IBM App Connect for Healthcare
IBM App Connect Enterprise
How to mitigate CVE-2026-66144
Install security update from vendor's website.
Apache Neethi - update to 3.2.3
DevOps Test Integrations and APIs - update to 12.0.0
DevOps Test Virtualization - update to 12.0.0
IBM App Connect Enterprise - update to 13.0.8.2
DevOps Test Integrations and APIs - update to 12.0.0
DevOps Test Virtualization - update to 12.0.0
IBM App Connect Enterprise - update to 13.0.8.2
External References
Related Security Bulletins
- Multiple vulnerabilities in Apache Neethi
- Multiple vulnerabilities in IBM App Connect Enterprise
- Multiple vulnerabilities in IBM Cloud Pak for Applications
- Multiple vulnerabilities in IBM Enterprise Application Runtimes
- Multiple vulnerabilities in App Connect for Healthcare
- Multiple vulnerabilities in IBM DevOps Test Virtualization/IBM DevOps Test Integrations and APIs