CVE-2026-66144 — Apache Neethi: Remote PolicyReference fetch lacks resource bounds
Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the API it can cause a denial of service attack if a huge pol…
Published: 2026-07-24 · CVSS: 7.5 · CVSS 3.1
Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the API it can cause a denial of service attack if a huge policy is retrieved. Users are recommended to upgrade to version 3.2.3, which fixes this issue by imposing a default maximum size on data read from remote policy references.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7