Uncontrolled Recursion

org.apache.neethi, neethi is vulnerable to uncontrolled recursion. The vulnerability is due to uncontrolled recursive policy parsing, which allows an attacker to provide a maliciously crafted deeply nested or ID-less policy that causes excessive runtime memory consumption and potentially crashes...

CVE-2026-101279

A flaw was found in OpenDMARC. A remote attacker can exploit this vulnerability by supplying a crafted Domain-based Message Authentication, Reporting, and Conformance DMARC policy record containing an invalid percentage pct value. This manipulation causes an integer overflow during policy parsing...

Security Bulletin: IBM WebSphere Application Server Liberty is affected by uncontrolled resource consumption vulnerabilities due to Apache Neethi (CVE-2026-66142, CVE-2026-66143, CVE-2026-66144)

Summary There is a vulnerability in the Apache Neethi library that affects IBM WebSphere Application Server Liberty with the jaxws-2.2, xmlWS-3.0, and xmlWS-4.0 enabled. Vulnerability Details CVEID:CVE-2026-66142 DESCRIPTION: Apache Neethi is vulnerable to uncontrolled recursion when parsing...

Security Bulletin: Security Vulnerability identified in neethi-3.2.2.jar used by IBM Maximo Application Suite - MREF ( CVE-2026-66142, CVE-2026-66143, CVE-2026-66144 )

Summary There is a vulnerability in neethi-3.2.2.jar used by IBM Maximo Application Suite - MREF Vulnerability Details CVEID:CVE-2026-66142 DESCRIPTION: Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lea...

Security Bulletin: Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager.

Summary Multiple vulnerabilities were addressed in IBM Sterling Partner Engagement Manager. Vulnerability Details CVEID:CVE-2026-66142 DESCRIPTION: Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to ...

Security Bulletin: IBM App Connect Enterprise is vulnerable to a denial of service due to Apache Neethi (CVE-2026-66142,CVE-2026-66143 & CVE-2026-66144)

Summary IBM App Connect Enterprise runtime is vulnerable to a denial of service due to Apache Neethi. Vulnerability Details CVEID:CVE-2026-66142 DESCRIPTION: Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which ma...

CVE-2026-80913

In the Linux kernel, the following vulnerability has been resolved: selinux: require every boolean value to be defined pbools.nprim comes from the policy image independently of how many booleans follow it, and condindexbool fills boolvaltostruct at value - 1, so a count larger than the values...

CVE-2026-80912 selinux: reject an unclaimed class value in security_get_classes()

In the Linux kernel, the following vulnerability has been resolved: selinux: reject an unclaimed class value in securitygetclasses securitygetclasses sizes an array by pclasses.nprim and fills it at value - 1, so a class value the policy never defines leaves a NULL. selmakeclasses passes every...

MiracleLinux 8 : [security - high] nodejs:24 (AXSA:2026-1352:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1352:01 advisory. ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42338 undici: undici: Denial of Service due to...

CVE-2026-66142

Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to a denial of service attack when parsing policies due to runtime memory exhaustion. Users are recommended to upgrade to version 3.2.3, which fixes th...

CVE-2026-66142 Apache Neethi: Uncontrolled recursion in policy processing

Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to a denial of service attack when parsing policies due to runtime memory exhaustion. Users are recommended to upgrade to version 3.2.3, which fixes th...

CVE-2026-66142

The Apache Neethi library is vulnerable to uncontrolled recursion during policy parsing, specifically when handling deeply nested structures or policies lacking policy Ids. This flaw can lead to a denial of service (DoS) attack caused by runtime memory exhaustion (CWE-400 ). This vulnerability af...

CVE-2026-66142 Apache Neethi: Uncontrolled recursion in policy processing

Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to a denial of service attack when parsing policies due to runtime memory exhaustion. Users are recommended to upgrade to version 3.2.3, which fixes th...

PT-2026-64288

Name of the Vulnerable Software and Affected Versions Apache Neethi versions prior to 3.2.3 Description Uncontrolled recursion occurs when parsing policies that lack policy Ids or contain deeply nested structures. This can lead to a denial of service attack resulting from runtime memory exhaustio...

OESA-2026-2214 xdg-dbus-proxy security update

xdg-dbus-proxy is a filtering proxy for D-Bus connections. It was originally part of the flatpak project, but it has been broken out as a standalone module to facilitate using it in other contexts. Security Fixes: xdg-dbus-proxy is a filtering proxy for D-Bus connections. Prior to 0.1.7, a policy...

[SECURITY] [DSA 6224-1] xdg-dbus-proxy security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6224-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff April 22, 2026 https://www.debian.org/security/faq -...

[SECURITY] [DLA 4542-1] xdg-dbus-proxy security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4542-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort April 21, 2026 https://wiki.debian.org/LTS -...

CVE-2026-34080 xdg-dbus-proxy has an eavesdrop filter bypass allowing message interception

xdg-dbus-proxy is a filtering proxy for D-Bus connections. Prior to 0.1.7, a policy parser vulnerability allows bypassing eavesdrop restrictions. The proxy checks for eavesdrop=true in policy rules but fails to handle eavesdrop ='true' with a space before the equals sign and similar cases. Client...

CVE-2026-34080 xdg-dbus-proxy has an eavesdrop filter bypass allowing message interception

xdg-dbus-proxy is a filtering proxy for D-Bus connections. Prior to 0.1.7, a policy parser vulnerability allows bypassing eavesdrop restrictions. The proxy checks for eavesdrop=true in policy rules but fails to handle eavesdrop ='true' with a space before the equals sign and similar cases. Client...

CVE-2026-34080 xdg-dbus-proxy has an eavesdrop filter bypass allowing message interception

xdg-dbus-proxy is a filtering proxy for D-Bus connections. Prior to 0.1.7, a policy parser vulnerability allows bypassing eavesdrop restrictions. The proxy checks for eavesdrop=true in policy rules but fails to handle eavesdrop ='true' with a space before the equals sign and similar cases. Client...