CVE-2026-42402

Katalog CVE

CVSS 7.5 · High EPSS 0,74%

Kerentanan Uncontrolled Resource Consumption pada apache neethi. Skor CVSS 3.1 7.5 (High) menurut apache.org.

Deskripsi (NVD)

Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalization. Specially crafted WS-Policy documents can trigger an exponential Cartesian cross-product expansion during the normalization process, causing unbounded memory allocation that exhausts the JVM heap. This occurs when the normalization process generates an excessive number of policy alternatives without bounds, leading to runtime memory exhaustion. Users should upgrade to 3.2.2 which limits the maximum number of normalized policy alternatives.

Rincian

Terbit di NVD

1 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber apache.org
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption

EPSS (30 hari)

0,74% peluang dieksploitasi; lebih tinggi dari 53,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/p826j0phhmr9f83wzpmys1y0bdfrr2q4 mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2026/05/01/6 mailing list · advisory pihak ketiga