CVE-2026-66143

Apache Neethi: Missing global alternative-output budget across policy computation paths

7.5 High

It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain crafted policies, which may lead to a denial of service attack via resource consumption. Users are recommended to upgrade to version 3.2.3, which fixes this issue.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.85%Up 0.5 points since Jul 25, 2026

What each source reports

CVE List Score used 7.5

Apache Neethi: Missing global alternative-output budget across policy computation paths

Record: CVE-2026-66143
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

EUVDEUVD-2026-48579 7.5

Record: EUVD-2026-48579
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-ghwq-2rg5-c7j8 7.5

It is possible to bypass the maximum number of normalized policy alternatives that was introduced...

Record: GHSA-ghwq-2rg5-c7j8
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

NVD 7.5

Record: CVE-2026-66143
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

OSV 7.5

Apache Neethi: Missing global alternative-output budget across policy computation paths

Record: CVE-2026-66143
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

OSVRHLW-2026-2f27e699c38d33d5 7.5

Lightwell Security Advisory: neethi 3.2.2.rhlw-00006

Red Hat Lightwell has released org.apache.neethi:neethi 3.2.2.rhlw-00006 with backported fixes for CVE-2026-66142, CVE-2026-66143, and CVE-2026-66144.

CVE-2026-66142: Apache Neethi: Uncontrolled recursion in policy processing

CVE-2026-66143: Apache Neethi: Missing global alternative-output budget across policy computation paths

CVE-2026-66144: Apache Neethi: Remote PolicyReference fetch lacks resource bounds

This patched artifact is a drop-in replacement for org.apache.neethi:neethi 3.2.2 from Maven Central.

Record: RHLW-2026-2f27e699c38d33d5
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.apache.neethi:neethi` Red Hat Lightwell:Maven From an advisory covering 3 CVEs	before 3.2.2.rhlw-00006, plus listed versions 2.02.0.12.0.22.0.32.0.4 Show 10 moreShow less 2.0.53.0.03.0.13.0.23.0.33.1.03.1.13.2.03.2.13.2.2	3.2.2.rhlw-00006

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-66143 is a high vulnerability (CVSS 7.5) in Apache Neethi, published July 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.85%, the 58th percentile. No source names a fixed version.

References

Show 6 moreShow less