CVE-2026-66144: Apache Neethi: Remote PolicyReference fetch lacks resource bounds
Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the API it can cause a denial of service attack if a huge policy is retrieved. Users are recommended to upgrade to version 3.2.3, which fixes this issue by imposing a default maximum size on data read from remote policy references.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Neethito a version that resolves this vulnerability.Fixed in 3.2.3 - Compensating control
If your environment retrieves remote policy references manually via the API, ensure retrieval is bounded (e.g., enforce limits on remote policy reference size/response size) to reduce risk of denial of service; upgrade to Apache Neethi 3.2.3 which imposes a default maximum size on data read from remote policy references.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66144?
CVE-2026-66144 has a severity rating of high with a score of 7.5 based on the CVSS 3.1 metrics.
How do I fix CVE-2026-66144?
To fix CVE-2026-66144, users should upgrade to Apache Neethi version 3.2.3 or later.
What is the risk associated with CVE-2026-66144?
The risk associated with CVE-2026-66144 includes the potential for a denial of service attack if a large policy is retrieved via the API.
Can CVE-2026-66144 be exploited remotely?
Yes, CVE-2026-66144 can be exploited remotely if the API is accessed to retrieve large policies.
Does CVE-2026-66144 affect data confidentiality or integrity?
CVE-2026-66144 does not affect data confidentiality or integrity, but it can affect availability due to potential denial of service.