What is the CVSS score of CVE-2026-66143?

CVE-2026-66143 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-66143?

Yes, a patch is available for CVE-2026-66143. Update the affected software to the latest version immediately.

Apache Neethi CVE-2026-66143

EUVD-2026-48579 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-24 apache

GHSA-ghwq-2rg5-c7j8

Denial Of Service Apache Apache Neethi Apache Software Foundation

7.5

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

7.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network attack with low complexity, no privileges or user interaction; only availability impact from resource consumption.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 11:50 vuln.today

CVSS changed

Jul 24, 2026 - 19:22 NVD

7.5 (HIGH)

Patch available

Jul 24, 2026 - 14:32 EUVD

CVE Published

Jul 24, 2026 - 12:07 cve.org

HIGH 7.5

DescriptionCVE.org

It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain crafted policies, which may lead to a denial of service attack via resource consumption. Users are recommended to upgrade to version 3.2.3, which fixes this issue.

AnalysisAI

Denial of service in Apache Neethi versions before 3.2.3 allows unauthenticated remote attackers to bypass a limit on normalized policy alternatives using crafted WS-Policy documents, causing resource exhaustion. The flaw was introduced with the limit in version 3.2.2 and has a CVSS of 7.5 but very low EPSS probability (0.33%), with no active exploitation or public exploit code reported. Upgrading to version 3.2.3 fully resolves the issue.

Technical ContextAI

Apache Neethi is a web services policy framework used to parse and normalize WS-Policy expressions. The root cause is a logic error (CWE-400 Uncontrolled Resource Consumption) that permits an attacker to avoid the maximum alternative limit that was added to prevent algorithmic complexity attacks during policy normalization. This allows a crafted policy document to trigger excessive CPU or memory usage. Affected products are all Apache Neethi versions from the Apache Software Foundation, as identified by CPE cpe:2.3:a:apache_software_foundation:apache_neethi:*:*:*:*:*:*:*:* up to 3.2.2.

RemediationAI

The primary remediation is upgrading to Apache Neethi 3.2.3, which removes the bypass. The vendor advisory provides details. As a temporary workaround, if an immediate upgrade is not possible, administrators should disable processing of untrusted WS-Policy documents in applications that incorporate Neethi, recognizing this may break functionality that relies on dynamic policy exchange.