CVE-2026-66143CWE-400

Apache Neethi: Missing global alternative-output budget across policy computation paths

High · published July 24, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
57.9
In the wild
Unconfirmed
What it is

It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain crafted policies, which may lead to a denial of service attack via resource consumption. Users are recommended to upgrade to version 3.2.3, which fixes this issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00854 · 57.9th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-07-24T12:07Z
EPSS history
Timeline
  • 24 JUL 12:07Z
    Apache Neethi: Missing global alternative-output budget across policy computation paths
    cvelistv5