CVE-2026-42403

Apache Neethi does not properly detect circular references in policy definitions. When a WS-Policy document contains circular policy references (where Policy A references Policy B which references Policy A), the policy normalization process can enter an infinite loop or cause excessive recursion, leading to a stack overflow or application hang. An attacker can craft malicious policy documents with circular references to cause a Denial of Service condition Users are recommended to upgrade to version 3.2.2, which fixes this issue.

• CWE-400

• https://lists.apache.org/thread/zm6t8skkkskjwk1881l4m4n0l7dqclzoMailing List, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2026/05/01/7Mailing List, Third Party Advisory

Published

May 1, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42398Server-Side Request Forgery (CWE-918) in Kibana allows authe…7.7
• CVE-2026-42399Uncontrolled Resource Consumption (CWE-400) in Kibana can le…6.5
• CVE-2026-4240A vulnerability was determined in Open5GS up to 2.7.6. The a…7.5
• CVE-2026-42400Uncontrolled Resource Consumption (CWE-400) in Kibana can le…6.5
• CVE-2026-42401Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2026-42402Apache Neethi is vulnerable to a Denial of Service attack th…7.5
• CVE-2026-42404Apache Neethi does not impose any restrictions on URIs when …7.2
• CVE-2026-42406A vulnerability exists in BIG-IP and BIG-IQ systems where a …8.7
• CVE-2026-42408When BIG-IP DNS is provisioned, a vulnerability exists in an…6.7
• CVE-2026-42409When an HTTP/2 profile and an iRule containing the HTTP::red…8.7
• CVE-2026-4241A vulnerability was identified in itsourcecode College Manag…6.3
• CVE-2026-42410Improper Neutralization of Input During Web Page Generation …6.5