Description
When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slowly can keep the fetch alive indefinitely and tie up the calling thread (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.
Affected products
apache: neethi
References2
- lists.apache.org/thread/dsr2ktf199mqhw2jtlbklyz7tzd86ycd Mailing ListVendor Advisory
- www.openwall.com/lists/oss-security/2026/09/18/14 Mailing ListThird Party Advisory
Metrics
- CVSS 3.1
-
4.3
MEDIUM
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - EPSS — exploit probability
- 0% percentile: 43 · as of 8 November 2026
- CWE
- CWE-400
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.