CVE-2026-42404

7.2 Élevée

Publiée le 01/05/2026 à 13:16 · Modifiée le 17/06/2026 à 12:47 · Analysée par le NVD · Source : security@apache.org

Description

Apache Neethi does not impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API. When an application explicitly calls the API to retrieve a policy from a remote URI, an outbound request is made for arbitrary protocols and internal IP adddresses. From 3.2.2, only http or https URIs are allowed, and link-local/multicast/any-local addresses are forbidden. Users are recommended to upgrade to version 3.2.2, which fixes this issue.

Traduire en français

Produits concernés

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.5 Moyenne	security@apache.org	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N`
3.1	7.2 Élevée	nvd@nist.gov (NVD)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-918

Références

https://lists.apache.org/thread/zdspnt64zznyjyn648553kptx69w23oq Issue TrackingVendor Advisory
http://www.openwall.com/lists/oss-security/2026/05/01/8 Mailing ListThird Party Advisory

CVE-2026-42404

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs