As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-91867: Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitely
Apache Neethi before version 3.2.4 contains a denial of service vulnerability in remote policy fetch handling. The affected versions enforce only per-read timeouts, not a total timeout for the entire transfer, allowing a slow server to keep the connection open indefinitely and exhaust the calling thread. Version 3.2.4 addresses this issue.
Why it matters: Teams deploying Apache Neethi before 3.2.4 should upgrade immediately to prevent denial of service attacks via slow remote policy servers that can hang application threads.
- Source published
- First seen by Cybersecurity Tracker