CVE-2026-42404: Apache Neethi: Unrestricted HTTP Redirect Following in Policy References

[Colm O hEigeartaigh <coheigea () apache org>]

Severity: Medium

Affected versions:

- Apache Neethi before 3.2.2

Description:

Apache Neethi does not impose any restrictions on URIs when manually
fetching remote policy references through the PolicyReference API.
When an application explicitly calls the API to retrieve a policy from
a remote URI, an outbound request is made for arbitrary protocols and
internal IP adddresses. From 3.2.2, only http or https URIs are
allowed, and link-local/multicast/any-local addresses are forbidden.

Users are recommended to upgrade to version 3.2.2, which fixes this issue.

References:

https://ws.apache.org/neethi/security.html
https://www.cve.org/CVERecord?id=CVE-2026-42404