CVE-2026-91867
Received Received - Intake

Neethi Remote Policy Fetch Denial of Service

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: Apache Software Foundation

Description
When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slowly can keep the fetch alive indefinitely and tie up the calling thread (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-91867
EUVD
EUVD-2026-83889

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache neethi 3.2.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves Neethi fetching a remote policy reference without limiting the total transfer time. A malicious server can send data slowly to keep the connection open indefinitely, consuming resources and causing a denial of service by tying up the calling thread.

Detection Guidance

Detecting this vulnerability requires checking if your Apache Neethi version is below 3.2.4. Run the command: neethi --version or check your dependency files (e.g., pom.xml for Maven) to verify the installed version. If the version is older than 3.2.4, the system is vulnerable.

Impact Analysis

This vulnerability can lead to denial of service, where an attacker consumes system resources by keeping connections open. It may cause applications relying on Neethi to become unresponsive or crash due to thread exhaustion.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it primarily causes denial of service by tying up threads during remote policy fetches. However, prolonged downtime or service disruption could indirectly impact compliance by failing to meet availability requirements in regulated environments.

Mitigation Strategies

Upgrade Neethi to version 3.2.4 or later to address the denial of service vulnerability caused by slow byte trickling during remote policy reference fetching.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91867. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart