PatchTheCVEneethi vulnerabilities and fixes
Recent CVEs affecting neethi, with upgrade or downgrade steps. 3 tracked.
neethi has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 3. Most recent: 2026-07-24. Highest priority: CVE-2026-66143 (score 51/100).
- CVE-2026-66143 HIGH 7.5 DOWNGRADE It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Ne
- CVE-2026-66142 HIGH 7.5 UPGRADE Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deepl
- CVE-2026-66144 HIGH 7.5 UPGRADE Although remote policy references are not retrieved during policy normalization, if they are manually retrieve
FAQ
How do I fix neethi vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is neethi being exploited right now?
None of the tracked neethi CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which neethi CVE should I patch first?
CVE-2026-66143 currently ranks highest (51/100): It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Ne.