{"id":"CVE-2026-42402","aliases":["EUVD-2026-26485","GHSA-g36m-9g3m-2vmp","RHLW-2026-53fe7bbf25ea635a"],"status":"published","title":"Apache Neethi: Policy Normalization Unbounded Resource Allocation DoS","description":"Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalization. Specially crafted WS-Policy documents can trigger an exponential Cartesian cross-product expansion during the normalization process, causing unbounded memory allocation that exhausts the JVM heap. This occurs when the normalization process generates an excessive number of policy alternatives without bounds, leading to runtime memory exhaustion.\n\nUsers should upgrade to 3.2.2 which limits the maximum number of normalized policy alternatives.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00711,"percentile":0.53837,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2026-05-01T08:54:41Z","modified":"2026-10-28T02:30:54Z","fixes":[{"ecosystem":"Maven","package":"org.apache.neethi:neethi","fixed_in":["3.2.2"],"sources":["ghsa","osv"]},{"ecosystem":"Red Hat Lightwell:Maven","package":"org.apache.neethi:neethi","fixed_in":["3.2.1.rhlw-00003"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.neethi:neethi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.neethi:neethi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2"}]}],"versions":["2.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","3.0.0","3.0.1","3.0.2","3.0.3","3.1.0","3.1.1","3.2.0","3.2.1"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.apache.neethi:neethi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1.rhlw-00003"}]}],"versions":["2.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","3.0.0","3.0.1","3.0.2","3.0.3","3.1.0","3.1.1","3.2.0","3.2.1"]}],"products":[{"vendor":"apache","product":"neethi"},{"vendor":"apache software foundation","product":"apache neethi"}],"references":[{"url":"https://lists.apache.org/thread/p826j0phhmr9f83wzpmys1y0bdfrr2q4","tags":["vendor-advisory","Mailing List","Vendor Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/05/01/6","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42402","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g36m-9g3m-2vmp","tags":["advisory"]},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42402.json","tags":["advisory"]},{"url":"https://github.com/apache/ws-neethi","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-42402","title":"Apache Neethi: Policy Normalization Unbounded Resource Allocation DoS","description":"Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalization. Specially crafted WS-Policy documents can trigger an exponential Cartesian cross-product expansion during the normalization process, causing unbounded memory allocation that exhausts the JVM heap. This occurs when the normalization process generates an excessive number of policy alternatives without bounds, leading to runtime memory exhaustion.\n\nUsers should upgrade to 3.2.2 which limits the maximum number of normalized policy alternatives.","status":"published","published":"2026-05-01T08:54:41.427Z","modified":"2026-05-01T16:21:05.909Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T13:40:23.731501Z"}],"euvd":[{"id":"EUVD-2026-26485","description":"Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalization. Specially crafted WS-Policy documents can trigger an exponential Cartesian cross-product expansion during the normalization process, causing unbounded memory allocation that exhausts the JVM heap. This occurs when the normalization process generates an excessive number of policy alternatives without bounds, leading to runtime memory exhaustion.\n\nUsers should upgrade to 3.2.2 which limits the maximum number of normalized policy alternatives.","status":"published","published":"2026-05-01T08:54:41Z","modified":"2026-05-01T16:21:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T19:05:18.723006Z"}],"ghsa":[{"id":"GHSA-g36m-9g3m-2vmp","title":"Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalization","description":"Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalization. Specially crafted WS-Policy documents can trigger an exponential Cartesian cross-product expansion during the normalization process, causing unbounded memory allocation that exhausts the JVM heap. This occurs when the normalization process generates an excessive number of policy alternatives without bounds, leading to runtime memory exhaustion.\n\nUsers should upgrade to 3.2.2 which limits the maximum number of normalized policy alternatives.","status":"published","published":"2026-05-01T09:30:25Z","modified":"2026-05-07T02:52:06Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:40:03.762927Z"}],"nvd":[{"id":"CVE-2026-42402","description":"Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalization. Specially crafted WS-Policy documents can trigger an exponential Cartesian cross-product expansion during the normalization process, causing unbounded memory allocation that exhausts the JVM heap. This occurs when the normalization process generates an excessive number of policy alternatives without bounds, leading to runtime memory exhaustion.\n\nUsers should upgrade to 3.2.2 which limits the maximum number of normalized policy alternatives.","status":"published","published":"2026-05-01T09:16:16.98Z","modified":"2026-10-26T21:10:00.17Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:12:16.626888Z"}],"osv":[{"id":"CVE-2026-42402","title":"Apache Neethi: Policy Normalization Unbounded Resource Allocation DoS","description":"Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalization. Specially crafted WS-Policy documents can trigger an exponential Cartesian cross-product expansion during the normalization process, causing unbounded memory allocation that exhausts the JVM heap. This occurs when the normalization process generates an excessive number of policy alternatives without bounds, leading to runtime memory exhaustion.\n\nUsers should upgrade to 3.2.2 which limits the maximum number of normalized policy alternatives.","status":"published","published":"2026-05-01T08:54:41.427Z","modified":"2026-10-28T02:30:54.294228576Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:45:04.117819Z"},{"id":"GHSA-g36m-9g3m-2vmp","title":"Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalization","description":"Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalization. Specially crafted WS-Policy documents can trigger an exponential Cartesian cross-product expansion during the normalization process, causing unbounded memory allocation that exhausts the JVM heap. This occurs when the normalization process generates an excessive number of policy alternatives without bounds, leading to runtime memory exhaustion.\n\nUsers should upgrade to 3.2.2 which limits the maximum number of normalized policy alternatives.","status":"published","published":"2026-05-01T09:30:25Z","modified":"2026-09-10T03:51:05.517258827Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:47.119724Z"},{"id":"RHLW-2026-53fe7bbf25ea635a","title":"Lightwell Security Advisory: neethi 3.2.1.rhlw-00003","description":"Red Hat Lightwell has released org.apache.neethi:neethi 3.2.1.rhlw-00003 with a backported security fix.\n\nCVE-2026-42402: Apache Neethi: Policy Normalization Unbounded Resource Allocation DoS\n\nThis patched artifact is a drop-in replacement for org.apache.neethi:neethi 3.2.1 from Maven Central.","status":"published","published":"2026-09-15T20:40:02Z","modified":"2026-10-27T04:00:02.534746314Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"}]}}