CVE-2026-66142
Received Received - Intake

Uncontrolled Recursion in Apache Neethi Policy Parsing

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: Apache Software Foundation

Description
Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to a denial of service attack when parsing policies due to runtime memory exhaustion. Users are recommended to upgrade to version 3.2.3, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-66142
EUVD
EUVD-2026-48578

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache neethi 3.2.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy IDs or have deeply nested structures. This can cause a denial of service by exhausting runtime memory during policy processing.

Detection Guidance

Detecting this vulnerability requires checking the Apache Neethi version in use. If your system runs Apache Neethi before version 3.2.3, it is vulnerable. Use commands like 'find / -name "neethi*.jar" 2>/dev/null' to locate the library and 'java -jar <path-to-neethi.jar> --version' to check the version.

Impact Analysis

An attacker could exploit this by providing malicious policies, causing the system to crash or become unresponsive due to excessive memory usage. This disrupts normal operations and service availability.

Compliance Impact

This vulnerability may lead to denial of service due to memory exhaustion, which could disrupt services handling sensitive data. For GDPR, this could impact availability of personal data processing systems. For HIPAA, it may affect the integrity and availability of protected health information systems.

Mitigation Strategies

Upgrade Apache Neethi to version 3.2.3 or later to address the uncontrolled recursion vulnerability in policy parsing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66142. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart