EUVD-2026-48583
GHSA-pjvp-v6mq-82xv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (apache) · only source for this CVE.
CVSS VectorVendor: apache
Lifecycle Timeline
4DescriptionCVE.org
Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the API it can cause a denial of service attack if a huge policy is retrieved. Users are recommended to upgrade to version 3.2.3, which fixes this issue by imposing a default maximum size on data read from remote policy references.
AnalysisAI
Denial of service in Apache Neethi versions before 3.2.3 allows remote attackers to exhaust resources by manually retrieving an oversized remote policy via the API. The vulnerability is unauthenticated and network exploitable, but no active exploitation has been reported. A patch is available in version 3.2.3, which enforces a maximum size on remote policy references.
More in Apache Neethi
View allDenial of service in Apache Neethi versions before 3.2.3 allows unauthenticated remote attackers to bypass a limit on no
Denial of service via memory exhaustion in Apache Neethi versions prior to 3.2.3 allows remote unauthenticated attackers
Algorithmic complexity denial of service in Apache Neethi allows remote unauthenticated attackers to exhaust JVM heap me
Denial of Service in Apache Neethi WS-Policy processor allows remote unauthenticated attackers to crash applications or
Server-Side Request Forgery (SSRF) in Apache Neethi allows remote attackers to make arbitrary outbound requests to inter
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today