CVE-2026-66142, CVE-2026-66143, CVE-2026-66144

Data: 2026-08-01

Severity: High

CVSS Score:

CVE-2026-66142: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVE-2026-66143: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVE-2026-66144: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Riferimenti:

CVE-2026-66142:
- https://nvd.nist.gov/vuln/detail/CVE-2026-66142
- https://lists.apache.org/thread/fomwtwt4pzzhxn4fyn3skykto913vfzt
CVE-2026-66143:
- https://nvd.nist.gov/vuln/detail/CVE-2026-66143
- https://lists.apache.org/thread/s6o6p5pvcbcsk54dlg6j699t5gxol28w
CVE-2026-66144:
- https://nvd.nist.gov/vuln/detail/CVE-2026-66144
- https://lists.apache.org/thread/80xwwbhkqvbwkkmco6yl6fr5xkpdysjf

Libreria: org.apache.neethi:neethi (versioni affette: < 3.2.3)

Descrizione

[CVE-2026-66142] CWE-400: Uncontrolled Resource Consumption

Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to a denial of service attack when parsing policies due to runtime memory exhaustion. Users are recommended to upgrade to version 3.2.3, which fixes this issue.

[CVE-2026-66143] CWE-400: Uncontrolled Resource Consumption

It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain crafted policies, which may lead to a denial of service attack via resource consumption. Users are recommended to upgrade to version 3.2.3, which fixes this issue.

[CVE-2026-66144] CWE-400: Uncontrolled Resource Consumption

Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the API it can cause a denial of service attack if a huge policy is retrieved. Users are recommended to upgrade to version 3.2.3, which fixes this issue by imposing a default maximum size on data read from remote policy references.

GovWay

Versione affette:

3.3.x: <= 3.3.20
3.4.x: <= 3.4.3

Risoluzione:

3.3.x: 3.3.21
3.4.x: 3.4.4