CVE-2026-91867: Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitely
Apache Neethi before 3.2.4 lacks a total timeout when fetching remote policies, letting a slow server hang the request thread indefinitely.
CVE-2026-91867 affects Apache Neethi (org.apache.neethi:neethi) versions before 3.2.4. When fetching a remote policy reference, Neethi limits only per-read time, not the whole transfer, so a server trickling bytes slowly can keep the fetch alive indefinitely and tie up the calling thread, causing denial of service. Users should upgrade to version 3.2.4, which fixes the issue.
30