CVE-2026-66144 Apache Neethi: Remote PolicyReference fetch lacks resource bounds

🗓️ 24 Jul 2026 12:08:27Reported by apacheType

Apache Neethi remote policy references can cause denial of service via API; upgrade to 3.2.3.

Reporter	Title	Published	Views	Family All 34
IBM Security Bulletins	Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in WebSphere Application Server Liberty	12 Oct 202614:57	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect Data Virtualization on IBM Software Hub (July 2026 - Part 2 of 2)	7 Aug 202601:27	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server Liberty is affected by uncontrolled resource consumption vulnerabilities due to Apache Neethi (CVE-2026-66142, CVE-2026-66143, CVE-2026-66144)	15 Sep 202603:13	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager.	9 Sep 202607:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to a denial of service due to Apache Neethi (CVE-2026-66142,CVE-2026-66143 & CVE-2026-66144)	7 Sep 202615:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Lifecycle Management products using IBM WebSphere Application Server Liberty is affected by uncontrolled resource consumption vulnerabilities due to Apache Neethi (CVE-2026-66142, CVE-2026-66143, CVE-2026-66144)	22 Sep 202607:01	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of WebSphere Application Server Liberty, IBM Tivoli Application Dependency Discovery Manager is affected by multiple vulnerabilities	10 Oct 202603:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Analytic Server is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty	4 Oct 202617:43	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Voice Gateway	7 Oct 202622:03	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Content Management Interoperability Services(CMIS) 3.0.7-IF15	4 Sep 202608:06	–	ibm

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.neethi:neethi",
    "product": "Apache Neethi",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "3.2.3",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread/80xwwbhkqvbwkkmco6yl6fr5xkpdysjf

24 Jul 2026 12:08Current

CVSS 3.17.5

EPSS0.0074

SSVC

CWE-400