CVE-2026-42402

Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalization. Specially crafted WS-Policy documents can trigger an exponential Cartesian cross-product expansion during the normalization process, causing unbounded memory allocation that exhausts the JVM heap. This occurs when the normalization process generates an excessive number of policy alternatives without bounds, leading to runtime memory exhaustion. Users should upgrade to 3.2.2 which limits the maximum number of normalized policy alternatives.

• CWE-400

• https://lists.apache.org/thread/p826j0phhmr9f83wzpmys1y0bdfrr2q4Mailing List, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2026/05/01/6Mailing List, Third Party Advisory

Published

May 1, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42397Allocation of Resources Without Limits or Throttling (CWE-77…6.5
• CVE-2026-42398Server-Side Request Forgery (CWE-918) in Kibana allows authe…7.7
• CVE-2026-42399Uncontrolled Resource Consumption (CWE-400) in Kibana can le…6.5
• CVE-2026-4240A vulnerability was determined in Open5GS up to 2.7.6. The a…7.5
• CVE-2026-42400Uncontrolled Resource Consumption (CWE-400) in Kibana can le…6.5
• CVE-2026-42401Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2026-42403Apache Neethi does not properly detect circular references i…7.5
• CVE-2026-42404Apache Neethi does not impose any restrictions on URIs when …7.2
• CVE-2026-42406A vulnerability exists in BIG-IP and BIG-IQ systems where a …8.7
• CVE-2026-42408When BIG-IP DNS is provisioned, a vulnerability exists in an…6.7
• CVE-2026-42409When an HTTP/2 profile and an iRule containing the HTTP::red…8.7
• CVE-2026-4241A vulnerability was identified in itsourcecode College Manag…6.3