CVE-2026-42404 Apache Neethi: Unrestricted HTTP Redirect Following in Policy References

🗓️ 01 May 2026 09:46:49Reported by apacheType

Apache Neethi permits unrestricted remote policy fetches; 3.2.2 restricts to Hypertext Transfer Protocol and blocks local addresses.

Reporter	Title	Published	Views	Family All 30
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities affect IBM Tivoli Netcool Impact 7.1.1.0	1 Jul 202619:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Apache HttpClient and Apache Neethi ( CVE-2026-40542, CVE-2026-42402, CVE-2026-42403 & CVE-2026-42404 )	29 Jun 202608:30	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server Liberty is affected by multiple vulnerabilities due to Neethi (CVE-2026-42402, CVE-2026-42403, CVE-2026-42404)	23 Jun 202612:55	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities Identified in Apache Neethi Allowing Denial of Service and Unauthorized Outbound Requests, which impacts IBM Tivoli Netcool Configuration Manager	31 Jul 202612:12	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect for Healthcare is vulnerable to multiple vulnerabilities due to Apache Log4j and Apache Neethi	8 Jun 202611:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities	20 May 202620:13	–	ibm
ATTACKERKB	CVE-2026-42404	1 May 202609:46	–	attackerkb
BDU FSTEC	The vulnerability of the PolicyReference programming interface in the Java framework of Apache Neethi allows a perpetrator to gain unauthorized access to protected information.	17 Aug 202600:00	–	bdu_fstec
Chainguard	CVE-2026-42404 vulnerabilities	12 May 202619:18	–	cgr
CNNVD	Apache Neethi 代码问题漏洞	1 May 202600:00	–	cnnvd

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.neethi:neethi",
    "product": "Apache Neethi",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "3.2.2",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread/zdspnt64zznyjyn648553kptx69w23oq

01 May 2026 09:46Current

CVSS 3.16.5

EPSS0.00497

CWE-918