Vulnerability in Apache Software Foundation Apache Neethi

[ Description ]Official description

When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slowly can keep the fetch alive indefinitely and tie up the calling thread (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund3 Nov 2026WID-SEC-2026-4320

  IBM WebSphere Application Server: Multiple vulnerabilities allow denial of service Translated from German

  Risk mediumCVE-2026-91865CVE-2026-91867

[ References ]References

• lists.apache.org/thread/dsr2ktf199mqhw2jtlbklyz7tzd86ycdvendor-advisory