{"id":"CVE-2026-91867","aliases":["EUVD-2026-83889","GHSA-8xvj-2pjr-73jq","RHLW-2026-5e3f8ccb11a37ba5"],"status":"published","title":"Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitely","description":"When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slowly can keep the fetch alive indefinitely and tie up the calling thread (denial of service).\nUsers are recommended to upgrade to version 3.2.4, which fixes this issue.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00497,"percentile":0.42948,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-400"],"published":"2026-09-21T11:27:45Z","modified":"2026-10-28T02:31:11Z","affected":[{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.apache.neethi:neethi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2.rhlw-00028"}]}],"versions":["2.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","3.0.0","3.0.1","3.0.2","3.0.3","3.1.0","3.1.1","3.2.0","3.2.1","3.2.2"],"bundled":4}],"products":[{"vendor":"apache","product":"neethi"},{"vendor":"apache software foundation","product":"apache neethi"}],"references":[{"url":"https://lists.apache.org/thread/dsr2ktf199mqhw2jtlbklyz7tzd86ycd","tags":["vendor-advisory","Mailing List","Vendor Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/18/14","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91867","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8xvj-2pjr-73jq"},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91867.json","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91863.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/72kxj71lvrqqx90xxqqctvpbw0t8mpxw","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91863","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91865.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/l48btqh02rlpsgf5p6r5ltqk1cb69dtc","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91865","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91866.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/zbfxnomgvbmqchqjgc6lk5h0z76k3gh4","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91866","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-91867","title":"Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitely","description":"When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slowly can keep the fetch alive indefinitely and tie up the calling thread (denial of service).\nUsers are recommended to upgrade to version 3.2.4, which fixes this issue.","status":"published","published":"2026-09-21T11:27:45.131Z","modified":"2026-09-21T13:15:19.316Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:19:52.773089Z"}],"euvd":[{"id":"EUVD-2026-83889","description":"When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slowly can keep the fetch alive indefinitely and tie up the calling thread (denial of service).\nUsers are recommended to upgrade to version 3.2.4, which fixes this issue.","status":"published","published":"2026-09-21T11:27:45Z","modified":"2026-09-21T13:15:19Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T17:28:05.72344Z"}],"ghsa":[{"id":"GHSA-8xvj-2pjr-73jq","title":"When Neethi fetches a remote policy reference, it only limits the time per read, not the whole...","description":"When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slowly can keep the fetch alive indefinitely and tie up the calling thread (denial of service).\nUsers are recommended to upgrade to version 3.2.4, which fixes this issue.","status":"published","published":"2026-09-21T12:32:39Z","modified":"2026-09-21T15:33:08Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:12:15.376121Z"}],"nvd":[{"id":"CVE-2026-91867","description":"When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slowly can keep the fetch alive indefinitely and tie up the calling thread (denial of service).\nUsers are recommended to upgrade to version 3.2.4, which fixes this issue.","status":"published","published":"2026-09-21T12:17:25.107Z","modified":"2026-09-25T13:09:43.217Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:12:50.043898Z"}],"osv":[{"id":"CVE-2026-91867","title":"Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitely","description":"When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slowly can keep the fetch alive indefinitely and tie up the calling thread (denial of service).\nUsers are recommended to upgrade to version 3.2.4, which fixes this issue.","status":"published","published":"2026-09-21T11:27:45.131Z","modified":"2026-10-28T02:31:11.242946008Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:20.269367Z"},{"id":"RHLW-2026-5e3f8ccb11a37ba5","title":"Lightwell Security Advisory: neethi 3.2.2.rhlw-00028","description":"Red Hat Lightwell has released org.apache.neethi:neethi 3.2.2.rhlw-00028 with backported fixes for CVE-2026-91863, CVE-2026-91865, CVE-2026-91866, and CVE-2026-91867.\n\nCVE-2026-91863: Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service\n\nCVE-2026-91865: Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service\n\nCVE-2026-91866: Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of service\n\nCVE-2026-91867: Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitely\n\nThis patched artifact is a drop-in replacement for org.apache.neethi:neethi 3.2.2 from Maven Central.","status":"published","published":"2026-10-20T11:56:50Z","modified":"2026-10-27T08:45:02.518267606Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"}]}}