CVE-2026-42403

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Apache Neethi does not properly detect circular references in policy definitions. When a WS-Policy document contains circular policy references (where Policy A references Policy B which references Policy A), the policy normalization process can enter an infinite loop or cause excessive recursion, leading to a stack overflow or application hang. An attacker can craft malicious policy documents with circular references to cause a Denial of Service condition

Users are recommended to upgrade to version 3.2.2, which fixes this issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published: May 1, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-424047.2Apache Neethi does not impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API. When CVE-2026-424068.7A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager CVE-2026-424084.4When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed TMOS Shell (tmsh) command that may allow a highly privileged authen CVE-2026-424097.5When an HTTP/2 profile and an iRule containing the HTTP::redirect or HTTP::respond command are configured on a virtual server, undisclosed r CVE-2026-42416.3A vulnerability was identified in itsourcecode College Management System 1.0. The impacted element is an unknown function of the file /admin CVE-2026-424106.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for CVE-2026-424118.1Unauthenticated Broken Authentication in CloudSecure WP Security <= 1.4.7 versions.CVE-2026-424126.5Missing Authorization vulnerability in weDevs WP User Frontend allows Exploiting Incorrectly Configured Access Control Security Levels. Thi CVE-2026-424137.5Unauthenticated Sensitive Data Exposure in Snapshotify – All-in-One Backup & Restore & Migrate <= 1.3.2 versions.CVE-2026-424148.5Subscriber SQL Injection in ListingPro <= 2.9.12 versions.CVE-2026-424159.3Unauthenticated SQL Injection in Porto Theme - Functionality <= 3.9.3 versions.CVE-2026-424168.5Subscriber SQL Injection in UDesign Core <= 4.15.0 versions.