What is GHSA-287c-fxr7-3w6c?

GHSA-287c-fxr7-3w6c is a security advisory published by GitHub Security Advisories with Medium severity. Apache Neethi doesn't impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API

Which CVE IDs does GHSA-287c-fxr7-3w6c cover?

GHSA-287c-fxr7-3w6c covers the following CVE IDs: CVE-2026-42404. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-287c-fxr7-3w6c?

GHSA-287c-fxr7-3w6c has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-287c-fxr7-3w6c?

GHSA-287c-fxr7-3w6c affects 1 product, including: maven/org.apache.neethi:neethi:\u003c 3.2.2.

GHSA-287c-fxr7-3w6cMediumCVSS 6.5

Apache Neethi doesn't impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API

Vendor

GitHub Security Advisories

Published

May 1, 2026

Last Modified

May 7, 2026

🔗 CVE IDs covered (1)

CVE-2026-42404 →

📋 Description

Apache Neethi does not impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API. When an application explicitly calls the API to retrieve a policy from a remote URI, an outbound request is made for arbitrary protocols and internal IP adddresses. From 3.2.2, only http or https URIs are allowed, and link-local/multicast/any-local addresses are forbidden.

Users are recommended to upgrade to version 3.2.2, which fixes this issue.

🎯 Affected products1

maven/org.apache.neethi:neethi:< 3.2.2

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-42404
https://lists.apache.org/thread/zdspnt64zznyjyn648553kptx69w23oq
http://www.openwall.com/lists/oss-security/2026/05/01/8
https://github.com/advisories/GHSA-287c-fxr7-3w6c