CVE-2026-66144

Apache Neethi: Remote PolicyReference fetch lacks resource bounds

7.5 High

Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the API it can cause a denial of service attack if a huge policy is retrieved. Users are recommended to upgrade to version 3.2.3, which fixes this issue by imposing a default maximum size on data read from remote policy references.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.74%Up 0.4 points since Jul 25, 2026

What each source reports

CVE List Score used 7.5

Apache Neethi: Remote PolicyReference fetch lacks resource bounds

Record: CVE-2026-66144
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

EUVDEUVD-2026-48583 7.5

Record: EUVD-2026-48583
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-pjvp-v6mq-82xv 7.5

Although remote policy references are not retrieved during policy normalization, if they are...

Record: GHSA-pjvp-v6mq-82xv
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

NVD 7.5

Record: CVE-2026-66144
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

OSV 7.5

Apache Neethi: Remote PolicyReference fetch lacks resource bounds

Record: CVE-2026-66144
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

OSVRHLW-2026-2f27e699c38d33d5 7.5

Lightwell Security Advisory: neethi 3.2.2.rhlw-00006

Red Hat Lightwell has released org.apache.neethi:neethi 3.2.2.rhlw-00006 with backported fixes for CVE-2026-66142, CVE-2026-66143, and CVE-2026-66144.

CVE-2026-66142: Apache Neethi: Uncontrolled recursion in policy processing

CVE-2026-66143: Apache Neethi: Missing global alternative-output budget across policy computation paths

CVE-2026-66144: Apache Neethi: Remote PolicyReference fetch lacks resource bounds

This patched artifact is a drop-in replacement for org.apache.neethi:neethi 3.2.2 from Maven Central.

Record: RHLW-2026-2f27e699c38d33d5
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.apache.neethi:neethi` Red Hat Lightwell:Maven From an advisory covering 3 CVEs	before 3.2.2.rhlw-00006, plus listed versions 2.02.0.12.0.22.0.32.0.4 Show 10 moreShow less 2.0.53.0.03.0.13.0.23.0.33.1.03.1.13.2.03.2.13.2.2	3.2.2.rhlw-00006

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-66144 is a high vulnerability (CVSS 7.5) in Apache Neethi, published July 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.74%, the 54th percentile. No source names a fixed version.

References

Show 6 moreShow less