CVE-2026-91867

MEDIUMCVSS 4.3

Description

When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slowly can keep the fetch alive indefinitely and tie up the calling thread (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.

Timeline

Published:September 21st, 2026 12:17 PM

Last modified:September 21st, 2026 6:10 PM

CVSS Scoring

CVSS v3: 4.3 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Weaknesses (CWE)

CWE-400

References & Reports

Advisories, patches, and third-party reports

https://lists.apache.org/thread/dsr2ktf199mqhw2jtlbklyz7tzd86ycd
http://www.openwall.com/lists/oss-security/2026/09/18/14

Source: NIST NVD · Data may lag official sources by up to one minute