CVE-2026-42403

Apache Neethi: Circular Policy Reference Infinite Loop

Published May 1, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

Apache Neethi does not properly detect circular references in policy definitions. When a WS-Policy document contains circular policy references (where Policy A references Policy B which references Policy A), the policy normalization process can enter an infinite loop or cause excessive recursion, leading to a stack overflow or application hang. An attacker can craft malicious policy documents with circular references to cause a Denial of Service condition

Users are recommended to upgrade to version 3.2.2, which fixes this issue.

Analysis

Technical impact

Apache Neethi fails to detect circular references in WS-Policy documents, allowing an attacker to craft a policy that triggers an infinite loop or stack overflow during policy normalisation. This flaw is a classic example of CWE-400: Uncontrolled Resource Consumption and CWE-606, and its primary impact is a denial of service where the application may crash, hang, or become unresponsive after processing the malicious policy.

Affected Systems

The Apache Software Foundation’s Apache Neethi library is affected; any version older than 3.2.2 is vulnerable. The recommended fix is to upgrade to the 3.2.2 release, which contains the patch for this issue.

Risk and Exploitability

The CVSS score of 7.5 indicates high severity, but the EPSS score of < 1% indicates a very low estimated probability of exploitation, so the likelihood remains limited. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw by supplying a crafted WS‑Policy document that contains circular references to a Neethi‑based application, triggering a denial of service on systems that accept or load remote policy documents, or on local applications that do not validate policy input.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apache Software Foundation

Apache Neethi

unaffected

Version	Status	Constraints
`0`	affected	< 3.2.2

Configuration 1 [-]

cpe:2.3:a:apache:neethi:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Apache

Neethi

Version	Status	Scheme	Platform
`[0,3.2.2)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Deploy the Apache Neethi 3.2.2 or newer release to replace any vulnerable libraries.
Enable or implement a policy validation layer that detects and rejects circular references before normalisation.
Implement a recursion depth or timeout limit during policy parsing to prevent infinite loops or stack overflows.

Generated by OpenCVE AI on May 14, 2026 at 13:54 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-2hfh-9h53-qc24	Apache Neethi does not properly detect circular references in policy definitions.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.763% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
http://www.openwall.com/lists/oss-security/2026/05/01/7
https://lists.apache.org/thread/zm6t8skkkskjwk1881l4m4n0l7dqclzo
https://nvd.nist.gov/vuln/detail/CVE-2026-42403
https://www.cve.org/CVERecord?id=CVE-2026-42403

History

May 14, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-606
References		https://nvd.nist.gov/vuln/detail/CVE-2026-42403 https://www.cve.org/CVERecord?id=CVE-2026-42403
Metrics	threat_severity `None`	threat_severity `Moderate`

May 1, 2026 6:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apache Apache neethi
CPEs		cpe:2.3:a:apache:neethi::::::::
Vendors & Products		Apache Apache neethi

May 1, 2026 5:30 PM Added references View changes

Type	Values Removed	Values Added
References		http://www.openwall.com/lists/oss-security/2026/05/01/7

May 1, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

May 1, 2026 9:15 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Apache Neethi does not properly detect circular references in policy definitions. When a WS-Policy document contains circular policy references (where Policy A references Policy B which references Policy A), the policy normalization process can enter an infinite loop or cause excessive recursion, leading to a stack overflow or application hang. An attacker can craft malicious policy documents with circular references to cause a Denial of Service condition Users are recommended to upgrade to version 3.2.2, which fixes this issue.
Title		Apache Neethi: Circular Policy Reference Infinite Loop
Weaknesses		CWE-400
References		https://lists.apache.org/thread/zm6t8skkkskjwk1881l4m4n0l7dqclzo
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`