CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-42403

Apache Neethi does not properly detect circular references in policy definitions. When a WS-Policy document contains circular policy references (where Policy A references Policy B which references Policy A), the policy normalization process can enter an infinite loop or cause excessive recursion, leading to a stack overflow or application hang. An attacker can craft malicious policy documents with circular references to cause a Denial of Service condition Users are recommended to upgrade to version 3.2.2, which fixes this issue.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.008

EPSS Ranking 52.0%

CVSS Severity

CVSS v3 Score 7.5

References

Products affected by CVE-2026-42403

Apache » Neethi » Version: 0.90

cpe:2.3:a:apache:neethi:0.90
Apache » Neethi » Version: 1.0

cpe:2.3:a:apache:neethi:1.0
Apache » Neethi » Version: 1.0.1

cpe:2.3:a:apache:neethi:1.0.1
Apache » Neethi » Version: 1.01

cpe:2.3:a:apache:neethi:1.01
Apache » Neethi » Version: 2.0

cpe:2.3:a:apache:neethi:2.0
Apache » Neethi » Version: 2.0.1

cpe:2.3:a:apache:neethi:2.0.1
Apache » Neethi » Version: 2.0.2

cpe:2.3:a:apache:neethi:2.0.2
Apache » Neethi » Version: 2.0.3

cpe:2.3:a:apache:neethi:2.0.3
Apache » Neethi » Version: 2.0.4

cpe:2.3:a:apache:neethi:2.0.4
Apache » Neethi » Version: 2.0.5

cpe:2.3:a:apache:neethi:2.0.5
Apache » Neethi » Version: 3.0.0

cpe:2.3:a:apache:neethi:3.0.0
Apache » Neethi » Version: 3.0.1

cpe:2.3:a:apache:neethi:3.0.1
Apache » Neethi » Version: 3.0.2

cpe:2.3:a:apache:neethi:3.0.2
Apache » Neethi » Version: 3.0.3

cpe:2.3:a:apache:neethi:3.0.3
Apache » Neethi » Version: 3.1.0

cpe:2.3:a:apache:neethi:3.1.0
Apache » Neethi » Version: 3.1.1

cpe:2.3:a:apache:neethi:3.1.1
Apache » Neethi » Version: 3.2.0

cpe:2.3:a:apache:neethi:3.2.0
Apache » Neethi » Version: 3.2.1

cpe:2.3:a:apache:neethi:3.2.1

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-42403

Products

Pricing

Contact Us