CVE-2026-66143 – Apache Neethi: Missing global alternative-output budget across policy computation paths

CVE ID :CVE-2026-66143

Published : July 24, 2026, 1:18 p.m. | 31 minutes ago

Description :It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain crafted policies, which may lead to a denial of service attack via resource consumption. Users are recommended to upgrade to version 3.2.3, which fixes this issue.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…