CVE-2026-66142

EUVD-2026-48578
Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to a denial of service attack when parsing policies due to runtime memory exhaustion. Users are recommended to upgrade to version 3.2.3, which fixes this issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 39.59%
Affected Products (NVD)
VendorProductVersion
apacheneethi
𝑥
< 3.2.3
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://lists.apache.org/thread/fomwtwt4pzzhxn4fyn3skykto913vfzt
http://www.openwall.com/lists/oss-security/2026/07/24/8