CVE-2026-91867: Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitely
When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slowly can keep the fetch alive indefinitely and tie up the calling thread (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Neethito a version that resolves this vulnerability.Fixed in 3.2.4
Event History
Frequently Asked Questions
What must an attacker control to exploit this issue?
The attacker needs to operate or control a remote server referenced by a policy that Neethi fetches. That server can keep the fetch active by sending data slowly enough to avoid the per-read timeout.
What is the operational impact?
A slow remote policy response can keep the calling thread blocked indefinitely. This can cause denial of service by tying up threads handling policy fetches.
What version resolves the issue?
Upgrade Apache Neethi to version 3.2.4, which fixes the missing total transfer timeout.