CVE-2026-42402

CVE-2026-42402 describes a Denial of Service in Apache Neethi due to algorithmic complexity in policy normalization. Crafted WS-Policy documents can trigger an exponential Cartesian cross-product expansion, causing unbounded memory growth and JVM heap exhaustion during normalization when too many...

CVE-2026-42403

Apache Neethi (CVE-2026-42403) can fail to detect circular WS-Policy references during policy normalization, causing infinite recursion or an infinite loop that may lead to stack overflow or application hang. An attacker can craft policy documents with circular references, resulting in Denial of ...

CVE-2026-42404

CVE-2026-42404 — Apache Neethi : The PolicyReference API allows an application calling a remote policy reference to initiate outbound requests to arbitrary protocols/IPs, with no URI restrictions pre-3.2.2. Reports indicate the issue enables unrestricted HTTP redirection when fetching remote poli...