Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-91867: Apache Neethi can be hung by slow server

CVE-2026-91867 · published 1 month ago

Summary

Apache Neethi may get stuck when it tries to download a policy from another server if that server sends data very slowly. This can tie up the application and stop it from working properly. Update Apache Neethi to version 3.2.4 to fix the problem.

What to do

Update apache software foundation apache neethi to version 3.2.4 or later.
Update apache neethi to version 3.2.4 or later.

Affected software

Vendor	Product	Affected versions
apache software foundation	apache neethi	< 3.2.4
apache	neethi	< 3.2.4 `cpe:2.3:a:apache:neethi::::::::`

Original advisory text

Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitely

When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slowly can keep the fetch alive indefinitely and tie up the calling thread (denial of service).
Users are recommended to upgrade to version 3.2.4, which fixes this issue.

References

http://www.openwall.com/lists/oss-security/2026/09/18/14 URL
https://lists.apache.org/thread/dsr2ktf199mqhw2jtlbklyz7tzd86ycd Vendor Advisory
https://repo.maven.apache.org/maven2 URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91867... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-91867 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

4.3 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-400Uncontrolled Resource Consumption

Timeline

Published21 Sep 2026

Updated4 Nov 2026

First seen21 Sep 2026

Sources

CVE-2026-91867 · NVD

CVE-2026-91867 · MITRE

CVE-2026-91867 · OSV

Track software like this

Free during beta