6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42404

CVE-2026-42404: Apache Neethi doesn't impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API

Apache Neethi does not impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API. When an application explicitly calls the API to retrieve a policy from a remote URI, an outbound request is made for arbitrary protocols and internal IP adddresses. From 3.2.2, only http or https URIs are allowed, and link-local/multicast/any-local addresses are forbidden.

Users are recommended to upgrade to version 3.2.2, which fixes this issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42404

CVE-2026-42404:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.apache.neethi:neethi	maven	< 3.2.2	3.2.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the getRemoteReferencedPolicy function of the org.apache.neethi.PolicyReference class. The function was intended to fetch remote policy references, but it lacked proper validation of the provided URI. This allowed an attacker to craft a malicious URI that could cause the server to make requests to arbitrary internal services or local files, leading to a Server-Side Request Forgery (SSRF) vulnerability. The patch addresses this by explicitly checking the URI scheme, allowing only http and https, and by adding checks to prevent connections to link-local, multicast, and any-local addresses. The vulnerable function is clearly identified in the commit history, and the patch directly addresses the described vulnerability.

Vulnerable functions

org.apache.neethi.PolicyReference.getRemoteReferencedPolicy

src/main/java/org/apache/neethi/PolicyReference.java

The `getRemoteReferencedPolicy` function was vulnerable to Server-Side Request Forgery (SSRF). Before the patch, it did not validate the URI scheme, allowing an attacker to specify arbitrary protocols (e.g., `file://`, `ftp://`) and access local or internal network resources. The patch restricts the allowed schemes to `http` and `https` and also validates the resolved IP address to prevent access to link-local, multicast, or wildcard addresses.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.