What’s Vulnerable › Vulnerabilities

CVE-2026-91867: Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitely

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-21 · updated 2026-09-25
• Weakness: CWE-400

Description

When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slowly can keep the fetch alive indefinitely and tie up the calling thread (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.

Affected products

• Apache Software Foundation Apache Neethi: before 3.2.4 — fixed in 3.2.4

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Neethi 3.2.4. Check the vendor advisory for mitigations.

References

• https://lists.apache.org/thread/dsr2ktf199mqhw2jtlbklyz7tzd86ycd
• http://www.openwall.com/lists/oss-security/2026/09/18/14

Get alerted when CVE-2026-91867 or the next vulnerability affects your stack