What is the CVSS score of CVE-2026-66142?

CVE-2026-66142 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Apache Neethi are affected by CVE-2026-66142?

Apache Neethi versions prior to 3.2.3 are vulnerable to a denial-of-service attack that could allow remote unauthenticated attackers to crash services by exploiting memory exhaustion.. A patch is available.

How to fix or mitigate CVE-2026-66142?

Within 24 hours, identify all systems running Apache Neethi versions prior to 3.2.3. Within 7 days, test and validate the upgrade to version 3.2.3 in a non-production environment. Within 30 days, apply the vendor-released patch (version 3.2.3) to all affected production systems.

Apache Neethi CVE-2026-66142

EUVD-2026-48578 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-24 apache

GHSA-vfqj-r56j-g77w

Denial Of Service Apache Apache Neethi Apache Software Foundation

7.5

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

7.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (apache) · only source for this CVE.

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 11:50 vuln.today

CVSS changed

Jul 24, 2026 - 19:22 NVD

7.5 (HIGH)

Patch available

Jul 24, 2026 - 14:32 EUVD

CVE Published

Jul 24, 2026 - 12:07 cve.org

HIGH 7.5

DescriptionCVE.org

Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to a denial of service attack when parsing policies due to runtime memory exhaustion. Users are recommended to upgrade to version 3.2.3, which fixes this issue.

AnalysisAI

Denial of service via memory exhaustion in Apache Neethi versions prior to 3.2.3 allows remote unauthenticated attackers to crash services by supplying crafted policies with deep nesting or missing Policy Ids. No public exploit or active exploitation is known; EPSS score (0.33%) indicates low current exploitation probability. Users should upgrade to version 3.2.3.