CVE-2026-42404: Apache Neethi: Unrestricted HTTP Redirect Following in Policy References
Apache Neethi does not impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API. When an application explicitly calls the API to retrieve a policy from a remote URI, an outbound request is made for arbitrary protocols and internal IP adddresses. From 3.2.2, only http or https URIs are allowed, and link-local/multicast/any-local addresses are forbidden.
Users are recommended to upgrade to version 3.2.2, which fixes this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Neethito a version that resolves this vulnerability.Fixed in 3.2.2 - Configuration
Configure/ensure Apache Neethi applies the restriction introduced in v3.2.2: allow only http or https URIs when resolving remote policy references via the PolicyReference API, and forbid link-local/multicast/any-local addresses.
Apache Neethi PolicyReference API allowed_policy_reference_uris = http, https only (forbid link-local/multicast/any-local addresses)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42404?
CVE-2026-42404 is classified as a moderate severity vulnerability due to unrestricted HTTP redirect following in policy references.
How do I fix CVE-2026-42404?
To mitigate CVE-2026-42404, update Apache Neethi to version 3.2.2 or later, where this issue is addressed.
What systems are affected by CVE-2026-42404?
CVE-2026-42404 affects Apache Neethi versions up to 3.2.2 that utilize the PolicyReference API for fetching remote policy references.
What are the risks associated with CVE-2026-42404?
The risks associated with CVE-2026-42404 include exposure to external malicious URLs, leading to potential redirection attacks.
How can I identify if my application is vulnerable to CVE-2026-42404?
To identify vulnerability to CVE-2026-42404, check if your application uses Apache Neethi versions prior to 3.2.2 and employs the PolicyReference API.