CVE-2026-42404

HighCVSS 7.2/10Last modified Oct 26, 2026

Description

Apache Neethi does not impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API. When an application explicitly calls the API to retrieve a policy from a remote URI, an outbound request is made for arbitrary protocols and internal IP adddresses. From 3.2.2, only http or https URIs are allowed, and link-local/multicast/any-local addresses are forbidden.

Users are recommended to upgrade to version 3.2.2, which fixes this issue.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Neethi	< 3.2.2

References

https://lists.apache.org/thread/zdspnt64zznyjyn648553kptx69w23oqIssue Tracking, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/05/01/8Mailing List, Third Party Advisory

Timeline

Published: May 1, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-424068.7A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager CVE-2026-424084.4When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed TMOS Shell (tmsh) command that may allow a highly privileged authen CVE-2026-424097.5When an HTTP/2 profile and an iRule containing the HTTP::redirect or HTTP::respond command are configured on a virtual server, undisclosed r CVE-2026-42416.3A vulnerability was identified in itsourcecode College Management System 1.0. The impacted element is an unknown function of the file /admin CVE-2026-424106.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for CVE-2026-424118.1Unauthenticated Broken Authentication in CloudSecure WP Security <= 1.4.7 versions.CVE-2026-424126.5Missing Authorization vulnerability in weDevs WP User Frontend allows Exploiting Incorrectly Configured Access Control Security Levels. Thi CVE-2026-424137.5Unauthenticated Sensitive Data Exposure in Snapshotify – All-in-One Backup & Restore & Migrate <= 1.3.2 versions.CVE-2026-424148.5Subscriber SQL Injection in ListingPro <= 2.9.12 versions.CVE-2026-424159.3Unauthenticated SQL Injection in Porto Theme - Functionality <= 3.9.3 versions.CVE-2026-424168.5Subscriber SQL Injection in UDesign Core <= 4.15.0 versions.CVE-2026-424179.3Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions.