VYPR
← All advisories
Medium severity4.3NVD Advisory· Published Sep 21, 2026· Updated Sep 25, 2026

CVE-2026-91867

CVE-2026-91867

Description

When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slowly can keep the fetch alive indefinitely and tie up the calling thread (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Apache/Neethi2 versions
    cpe:2.3:a:apache:neethi:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:apache:neethi:*:*:*:*:*:*:*:*range: <3.2.4
    • (no CPE)range: >=3.2.4

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.