Denial of Service Vulnerability in Apache Neethi Software

CVE-2026-42403

What is CVE-2026-42403?

Apache Neethi has a vulnerability that arises from its inability to properly detect circular references in WS-Policy documents. This issue can trigger an infinite loop or excessive recursion during the policy normalization process, which can lead to stack overflow or application hangs. Attackers may exploit this vulnerability by crafting malicious WS-Policy documents containing circular references, thus potentially causing a Denial of Service condition. Users are advised to update to version 3.2.2 to mitigate this risk effectively.

References