CVE-2026-66144: Apache Neethi: Remote PolicyReference fetch lacks resource bounds

[Colm O hEigeartaigh <coheigea () apache org>]

Severity: low 

Affected versions:

- Apache Neethi (org.apache.neethi:neethi) before 3.2.3

Description:

Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the 
API it can cause a denial of service attack if a huge policy is retrieved. Users are recommended to upgrade to version 
3.2.3, which fixes this issue by imposing a default maximum size on data read from remote policy references.

Credit:

Reported by LTSHFWJT (finder)

References:

https://ws.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-66144