---
id: CVE-2026-91867
title: >-
  When Neethi fetches a remote policy reference, it only limits the time per
  read, not the whole transfer, so a server that trickles bytes slowly can keep
  the fetch alive indefinitely and tie up the calling thread (denial of
  service).

  User…
summary: >-
  When Neethi fetches a remote policy reference, it only limits the time per
  read, not the whole transfer, so a server that trickles bytes slowly can keep
  the fetch alive indefinitely and tie up the calling thread (denial of
  service).

  User…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L'
cwe:
  - CWE-400
vendor: Apache Software Foundation
product: 'org.apache.neethi:neethi'
affected:
  - 'org.apache.neethi:neethi < 3.2.4'
published: '2026-09-21'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T18:10:30.343'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-91867'
references:
  - url: 'https://lists.apache.org/thread/dsr2ktf199mqhw2jtlbklyz7tzd86ycd'
    label: security@apache.org
  - url: 'http://www.openwall.com/lists/oss-security/2026/09/18/14'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-21T13:14:25.401436Z'
ingestedAt: '2026-09-21T11:35:54.434Z'
epss: 0.0022
epssPercentile: 0.12738
---

## Overview

When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slowly can keep the fetch alive indefinitely and tie up the calling thread (denial of service).
Users are recommended to upgrade to version 3.2.4, which fixes this issue.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.