CVE-2026-66142: Apache Neethi: Uncontrolled recursion in policy processing

[Colm O hEigeartaigh <coheigea () apache org>]

Severity: moderate 

Affected versions:

- Apache Neethi (org.apache.neethi:neethi) before 3.2.3

Description:

Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested 
structures, which may lead to a denial of service attack when parsing policies due to runtime memory exhaustion. Users 
are recommended to upgrade to version 3.2.3, which fixes this issue.

Credit:

Reported by LTSHFWJT (finder)

References:

https://ws.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-66142