Security Bulletin: Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager.

Summary Multiple vulnerabilities were addressed in IBM Sterling Partner Engagement Manager. Vulnerability Details CVEID:CVE-2026-66142 DESCRIPTION: Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to ...

Security Bulletin: IBM App Connect Enterprise is vulnerable to a denial of service due to Apache Neethi (CVE-2026-66142,CVE-2026-66143 & CVE-2026-66144)

Summary IBM App Connect Enterprise runtime is vulnerable to a denial of service due to Apache Neethi. Vulnerability Details CVEID:CVE-2026-66142 DESCRIPTION: Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which ma...

The vulnerability of the normalization mechanism for security policies in the Java framework Apache Neethi, which allows a violator to trigger a service failure.

The vulnerability of the normalization mechanism for security policies in the Java framework Apache Neethi is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...

CLSA-2026-1784682823 TuxCare security update for org.apache.neethi:neethi (1 CVE)

TuxCare rebuilt org.apache.neethi:neethi to address 1 CVE. Fixed in 3.1.1-tuxcare.2...

CVE-2026-66143

It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain crafted policies, which may lead to a denial of service attack via resource consumption. Users are recommended to upgrade to version 3.2.3, which fixes this issue...

CVE-2026-66142

Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to a denial of service attack when parsing policies due to runtime memory exhaustion. Users are recommended to upgrade to version 3.2.3, which fixes th...

CVE-2026-66144

CVE-2026-66144 concerns Apache Neethi: remote PolicyReference fetch lacks resource bounds during policy normalization. If a policy is retrieved in full via the API, a large policy can trigger a denial of service. The issue is mitigated by upgrading to version 3.2.3, which enforces a default maxim...

CVE-2026-66144 Apache Neethi: Remote PolicyReference fetch lacks resource bounds

Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the API it can cause a denial of service attack if a huge policy is retrieved. Users are recommended to upgrade to version 3.2.3, which fixes this issue by imposing a default maximu...

EUVD-2026-48579

It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain crafted policies, which may lead to a denial of service attack via resource consumption. Users are recommended to upgrade to version 3.2.3, which fixes this issue...

CVE-2026-66143 Apache Neethi: Missing global alternative-output budget across policy computation paths

It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain crafted policies, which may lead to a denial of service attack via resource consumption. Users are recommended to upgrade to version 3.2.3, which fixes this issue...

CVE-2026-66143

It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain crafted policies, which may lead to a denial of service attack via resource consumption. Users are recommended to upgrade to version 3.2.3, which fixes this issue...

CVE-2026-66143 Apache Neethi: Missing global alternative-output budget across policy computation paths

It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain crafted policies, which may lead to a denial of service attack via resource consumption. Users are recommended to upgrade to version 3.2.3, which fixes this issue...

CVE-2026-66143

CVE-2026-66143 affects Apache Neethi (policy computation paths). The issue, described as a missing global alternative-output budget, allows bypassing the maximum number of normalized policy alternatives introduced in Neethi 3.2.2 via crafted policies, potentially causing a denial of service throu...

EUVD-2026-48578

Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to a denial of service attack when parsing policies due to runtime memory exhaustion. Users are recommended to upgrade to version 3.2.3, which fixes th...

CVE-2026-66142

Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to a denial of service attack when parsing policies due to runtime memory exhaustion. Users are recommended to upgrade to version 3.2.3, which fixes th...

CVE-2026-66142 Apache Neethi: Uncontrolled recursion in policy processing

Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to a denial of service attack when parsing policies due to runtime memory exhaustion. Users are recommended to upgrade to version 3.2.3, which fixes th...

CVE-2026-66142

Apache Neethi is affected by uncontrolled recursion when parsing policies that lack policy IDs or that have deeply nested structures, potentially causing a denial of service through runtime memory exhaustion. The issue affects the Neethi policy processing component and is mitigated by upgrading t...

CVE-2026-66142 Apache Neethi: Uncontrolled recursion in policy processing

Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to a denial of service attack when parsing policies due to runtime memory exhaustion. Users are recommended to upgrade to version 3.2.3, which fixes th...

PT-2026-64288

Name of the Vulnerable Software and Affected Versions Apache Neethi versions prior to 3.2.3 Description Uncontrolled recursion occurs when parsing policies that lack policy Ids or contain deeply nested structures. This can lead to a denial of service attack resulting from runtime memory exhaustio...

PT-2026-64289

Name of the Vulnerable Software and Affected Versions Apache Neethi versions 3.2.2 through 3.2.2 Description Certain crafted policies can bypass the maximum number of normalized policy alternatives, potentially leading to a denial of service attack through excessive resource consumption...