CVE-2026-91867: Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitely

Q: What must an attacker control to exploit this issue?

The attacker needs to operate or control a remote server referenced by a policy that Neethi fetches. That server can keep the fetch active by sending data slowly enough to avoid the per-read timeout.

Q: What is the operational impact?

A slow remote policy response can keep the calling thread blocked indefinitely. This can cause denial of service by tying up threads handling policy fetches.

Q: What version resolves the issue?

Upgrade Apache Neethi to version 3.2.4, which fixes the missing total transfer timeout.

Published Sep 18, 2026

Updated

When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slowly can keep the fetch alive indefinitely and tie up the calling thread (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.

Affected Software

1 affected component

Apache Neethi<3.2.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Neethi to a version that resolves this vulnerability.
Fixed in 3.2.4

Event History

Sep 21, 2026

CVE Published

via MITRE·11:27 AM

Data Sourced

via MITRE·11:27 AM

Description

Frequently Asked Questions

What must an attacker control to exploit this issue?

The attacker needs to operate or control a remote server referenced by a policy that Neethi fetches. That server can keep the fetch active by sending data slowly enough to avoid the per-read timeout.

What is the operational impact?

A slow remote policy response can keep the calling thread blocked indefinitely. This can cause denial of service by tying up threads handling policy fetches.

What version resolves the issue?

Upgrade Apache Neethi to version 3.2.4, which fixes the missing total transfer timeout.

CVE-2026-91867: Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitely

Affected Software

Remediation

Event History

Frequently Asked Questions

What must an attacker control to exploit this issue?

What is the operational impact?

What version resolves the issue?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker control to exploit this issue?

What is the operational impact?

What version resolves the issue?