CVE-2026-42404

Medium

Description

Apache Neethi does not impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API. When an application explicitly calls the API to retrieve a policy from a remote URI, an outbound request is made for arbitrary protocols and internal IP adddresses. From 3.2.2, only http or https URIs are allowed, and link-local/multicast/any-local addresses are forbidden. Users are recommended to upgrade to version 3.2.2, which fixes this issue.

SeverityMedium

CVSS6.5

Exploit probability—

Product

Apache Neethi

PublishedMay 1, 2026

First seenMay 1, 2026

Weakness typeCWE-918Server-side request forgery (SSRF)

How to fix

Update

apache neethi3.2.2 or later
org.apache.neethi:neethi3.2.2 or later

Vendor advisories

lists.apache.org/thread/zdspnt64zznyjyn648553kptx69w23oq

Affected products

Product	Affected versions	Fixed in
apache neethi	v < 3.2.2	3.2.2
org.apache.neethi:neethiMaven	v < 3.2.2	3.2.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.