CVE-2026-66143: Apache Neethi: Missing global alternative-output budget across policy computation paths

[Colm O hEigeartaigh <coheigea () apache org>]

Severity: moderate 

Affected versions:

- Apache Neethi (org.apache.neethi:neethi) before 3.2.3

Description:

It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 
3.2.2 via certain crafted policies, which may lead to a denial of service attack via resource consumption. Users are 
recommended to upgrade to version 3.2.3, which fixes this issue.

Credit:

Reported by LTSHFWJT (finder)

References:

https://ws.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-66143