CVE-2026-42404Disclosure(apache / neethi)

LOWCVSS 7.2 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Apache Neethi does not impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API. When an application explicitly calls the API to retrieve a policy from a remote URI, an outbound request is made for arbitrary protocols and internal IP adddresses. From 3.2.2, only http or https URIs are allowed, and link-local/multicast/any-local addresses are forbidden. Users are recommended to upgrade to version 3.2.2, which fixes this issue.

apache CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-918

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

neethi

Threat summary

2 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
Disclosure: 1 classified signal
General: 1 classified signal
Peaked 1d ago at 1 mentions (2026-05-01); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

apache

Products

neethi

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

Disclosure

150.0%

General

150.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-01	1	Disclosure1
2026-05-02	1	General1

Full discourse2 posts

Open Source Security mailing list@oss_security159d
General
Apache Neethi CVE-2026-42402: Policy Normalization Resource Allocation DoS https://www.openwall.com/lists/oss-security/2026/05/01/6 CVE-2026-42403: Circular Policy Reference Infinite Loop https://www.openwall.com/lists/oss-security/2026/05/01/7 CVE-2026-42404: Unrestricted HTTP Redirect Following in Policy References https://www.openwall.com/lists/oss-security/2026/05/01/8
Post summary
The post lists three new CVEs for Apache Neethi with brief technical descriptions, but offers no PoC, exploit code, active exploitation evidence, or patch information.
00040423
4.7K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds160d
Disclosure
CVE-2026-42404 Unrestricted Remote URI Fetching in Apache Neethi PolicyReference API https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42404
Post summary
A newly disclosed CVE-2026-42404 affects Apache Neethi PolicyReference API, allowing unrestricted remote URI fetching; the post provides technical details but no PoC, exploit, patch, or exploitation evidence.
0000042
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	apache	neethi	-	-	-

Explore more

Back to dashboard apache CVEs neethi vulnerabilities