CVE-2026-66142

Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to a denial of service attack when parsing policies due to runtime memory exhaustion. Users are recommended to upgrade to version 3.2.3, which fixes th...

EUVD-2026-48583

Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the API it can cause a denial of service attack if a huge policy is retrieved. Users are recommended to upgrade to version 3.2.3, which fixes this issue by imposing a default maximu...

CVE-2026-66144

Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the API it can cause a denial of service attack if a huge policy is retrieved. Users are recommended to upgrade to version 3.2.3, which fixes this issue by imposing a default maximu...

CVE-2026-66144

CVE-2026-66144 concerns Apache Neethi: remote PolicyReference fetch lacks resource bounds during policy normalization. If a policy is retrieved in full via the API, a large policy can trigger a denial of service. The issue is mitigated by upgrading to version 3.2.3, which enforces a default maxim...

CVE-2026-66143 Apache Neethi: Missing global alternative-output budget across policy computation paths

It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain crafted policies, which may lead to a denial of service attack via resource consumption. Users are recommended to upgrade to version 3.2.3, which fixes this issue...

EUVD-2026-48579

It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain crafted policies, which may lead to a denial of service attack via resource consumption. Users are recommended to upgrade to version 3.2.3, which fixes this issue...

CVE-2026-66143

CVE-2026-66143 affects Apache Neethi (policy computation paths). The issue, described as a missing global alternative-output budget, allows bypassing the maximum number of normalized policy alternatives introduced in Neethi 3.2.2 via crafted policies, potentially causing a denial of service throu...

CVE-2026-66143

It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain crafted policies, which may lead to a denial of service attack via resource consumption. Users are recommended to upgrade to version 3.2.3, which fixes this issue...

EUVD-2026-48578

Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to a denial of service attack when parsing policies due to runtime memory exhaustion. Users are recommended to upgrade to version 3.2.3, which fixes th...

CVE-2026-66142

Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to a denial of service attack when parsing policies due to runtime memory exhaustion. Users are recommended to upgrade to version 3.2.3, which fixes th...

CVE-2026-66142

Apache Neethi is affected by uncontrolled recursion when parsing policies that lack policy IDs or that have deeply nested structures, potentially causing a denial of service through runtime memory exhaustion. The issue affects the Neethi policy processing component and is mitigated by upgrading t...

CVE-2026-66142 Apache Neethi: Uncontrolled recursion in policy processing

Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to a denial of service attack when parsing policies due to runtime memory exhaustion. Users are recommended to upgrade to version 3.2.3, which fixes th...

OESA-2026-3149 sssd security update

Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy...

OESA-2026-3148 sssd security update

Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy...

OESA-2026-3147 sssd security update

Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy...

PT-2026-64290

Name of the Vulnerable Software and Affected Versions affected versions not specified Description A denial of service can occur when remote policy references are manually retrieved via the API. This happens if a policy of excessive size is retrieved, leading to system instability or unavailabilit...

PT-2026-64288

Name of the Vulnerable Software and Affected Versions Apache Neethi versions prior to 3.2.3 Description Uncontrolled recursion occurs when parsing policies that lack policy Ids or contain deeply nested structures. This can lead to a denial of service attack resulting from runtime memory exhaustio...

PT-2026-64289

Name of the Vulnerable Software and Affected Versions Apache Neethi versions 3.2.2 through 3.2.2 Description Certain crafted policies can bypass the maximum number of normalized policy alternatives, potentially leading to a denial of service attack through excessive resource consumption...

openSUSE 16: ImageMagick / ImageMagick-config-7-SUSE / etc (openSUSE-SU-2026:21391-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21391-1 advisory. This update for ImageMagick fixes the following issues - CVE-2026-55628: Policy Bypass in concatenate operation due to missing checks bsc1270081...

PT-2026-64435

Name of the Vulnerable Software and Affected Versions Cloudreve versions prior to 4.17.0 Description An OAuth scope authorization bypass exists in the admin storage policy routes. A user with an OAuth bearer token scoped only to Admin.Read can access the 'POST /api/v4/admin/policy/oauth/signin'...