[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAB8XdGBXhqXV9t9Edoe09x5yzvvFbpzRSYaUV7oWFkEwx0cFXw@mail.gmail.com>
Date: Fri, 1 May 2026 09:22:03 +0100
From: Colm O hEigeartaigh <coheigea@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-42404: Apache Neethi: Unrestricted HTTP Redirect Following
in Policy References
Severity: Medium
Affected versions:
- Apache Neethi before 3.2.2
Description:
Apache Neethi does not impose any restrictions on URIs when manually
fetching remote policy references through the PolicyReference API.
When an application explicitly calls the API to retrieve a policy from
a remote URI, an outbound request is made for arbitrary protocols and
internal IP adddresses. From 3.2.2, only http or https URIs are
allowed, and link-local/multicast/any-local addresses are forbidden.
Users are recommended to upgrade to version 3.2.2, which fixes this issue.
References:
https://ws.apache.org/neethi/security.html
https://www.cve.org/CVERecord?id=CVE-2026-42404
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
