[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAB8XdGCYxL3hdpf2zBGefs7QJUSc901Kx-_-9L3WegrzGSDP9g@mail.gmail.com>
Date: Fri, 1 May 2026 09:20:48 +0100
From: Colm O hEigeartaigh <coheigea@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-42403: Apache Neethi: Circular Policy Reference Infinite Loop
Severity: High
Affected versions:
- Apache Neethi before 3.2.2
Description:
Apache Neethi does not properly detect circular references in policy
definitions. When a WS-Policy document contains circular policy
references (where Policy A references Policy B which references Policy
A), the policy normalization process can enter an infinite loop or
cause excessive recursion, leading to a stack overflow or application
hang. An attacker can craft malicious policy documents with circular
references to cause a Denial of Service condition
Users are recommended to upgrade to version 3.2.2, which fixes this issue.
References:
https://ws.apache.org/neethi/security.html
https://www.cve.org/CVERecord?id=CVE-2026-42403
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
