org.apache.neethi: Apache Neethi: Denial of Service via algorithmic complexity in policy normalization

🗓️ 20 May 2026 20:47:38Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 18 Views

Apache Neethi flaw lets remote attacker cause Denial of Service via policy normalization complexity.

Reporter	Title	Published	Views	Family All 32
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities affect IBM Tivoli Netcool Impact 7.1.1.0	1 Jul 202619:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Apache HttpClient and Apache Neethi ( CVE-2026-40542, CVE-2026-42402, CVE-2026-42403 & CVE-2026-42404 )	29 Jun 202608:30	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server Liberty is affected by multiple vulnerabilities due to Neethi (CVE-2026-42402, CVE-2026-42403, CVE-2026-42404)	23 Jun 202612:55	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities Identified in Apache Neethi Allowing Denial of Service and Unauthorized Outbound Requests, which impacts IBM Tivoli Netcool Configuration Manager	31 Jul 202612:12	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect for Healthcare is vulnerable to multiple vulnerabilities due to Apache Log4j and Apache Neethi	8 Jun 202611:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities	20 May 202620:13	–	ibm
ATTACKERKB	CVE-2026-42402	1 May 202608:54	–	attackerkb
BDU FSTEC	The vulnerability of the normalization mechanism for security policies in the Java framework Apache Neethi, which allows a violator to trigger a service failure.	17 Aug 202600:00	–	bdu_fstec
Chainguard	CVE-2026-42402 vulnerabilities	12 May 202619:18	–	cgr
Circl	CVE-2026-42402	1 May 202611:01	–	circl

Vulners

Node

AND

redhat apache_camel_quarkusRange<3.27

redhat enterprise_linux

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-42402
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
lists	www.lists.apache.org/thread/p826j0phhmr9f83wzpmys1y0bdfrr2q4
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-42402
cve	www.cve.org/CVERecord

30 Jul 2026 01:42Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.17.5

EPSS0.00711

SSVC

Apache Neethi Denial of Service remote attacker policy normalization algorithmic complexity java heap memory exhaustion