CVE-2026-91867: Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitely
Apache Neethi before 3.2.4 lacks a total timeout when fetching remote policies, letting a slow server hang the request thread indefinitely.
CVE-2026-91867 affects Apache Neethi (org.apache.neethi:neethi) versions before 3.2.4. When fetching a remote policy reference, Neethi limits only per-read time, not the whole transfer, so a server trickling bytes slowly can keep the fetch alive indefinitely and tie up the calling thread, causing denial of service. Users should upgrade to version 3.2.4, which fixes the issue.
- Fix released in Apache Neethi 3.2.4
- Denial of service via thread exhaustion on slow remote policy fetch
- Per-read timeout exists but no total transfer timeout
- CVEs
- CVE-2026-91867
- Vendors
- Apache Software Foundation
- Products
- Apache Neethi
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-91867 | Slow-Read DoS in Apache Neethi: Remote Policy Fetch Lacks Total Timeout (< 3.2.4) | 4.3 | — |
From the original article
Posted by Colm O hEigeartaigh on Sep 18 Severity: moderate Affected versions: - Apache Neethi (org. apache. neethi:neethi) before 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.