This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ws-neethi.git
The following commit(s) were added to refs/heads/master by this push:
new 6d4eccb Updating website for 3.2.4 release
6d4eccb is described below
commit 6d4eccb67e2649b666920a834d994be71a32c1c0
Author: Colm O hEigeartaigh <[email protected]>
AuthorDate: Fri Sep 18 16:32:09 2026 +0100
Updating website for 3.2.4 release
---
src/site/apt/index.apt | 4 +-
src/site/apt/security.apt | 113 +++++++++++++++++++++++++++++++++++++++++++++
src/site/xdoc/download.xml | 20 ++++----
3 files changed, 125 insertions(+), 12 deletions(-)
diff --git a/src/site/apt/index.apt b/src/site/apt/index.apt
index daabfdb..46a2e1f 100644
--- a/src/site/apt/index.apt
+++ b/src/site/apt/index.apt
@@ -28,9 +28,9 @@ Welcome to Apache Neethi
capabilities.
Latest Release
- <<July 2026 - Apache Neethi Version 3.2.3 Released!>>
+ <<September 2026 - Apache Neethi Version 3.2.4 Released!>>
- \[{{{http://ws.apache.org/neethi/download.cgi}Download Neethi 3.2.3}}\]
+ \[{{{http://ws.apache.org/neethi/download.cgi}Download Neethi 3.2.4}}\]
Note that this release fixes three CVEs, please see
{{{./security.html}Security Advisories (CVEs)}}.
diff --git a/src/site/apt/security.apt b/src/site/apt/security.apt
index 98d20c3..69a8f5b 100644
--- a/src/site/apt/security.apt
+++ b/src/site/apt/security.apt
@@ -28,6 +28,119 @@ Security and CVE Tracking
Apache Neethi CVEs
+ * {{{https://www.cve.org/CVERecord?id=CVE-2026-91863}CVE-2026-91863}}:
+ Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy
+ documents allows denial of service
+
+ * Severity: Moderate
+
+ * Affected versions:
+
+ - Apache Neethi (org.apache.neethi:neethi) before 3.2.4
+
+ * Description:
+
+ A specially crafted WS-Policy document with deeply nested policy
+ elements can bypass Neethi's nesting-depth limit and exhaust the thread
+ stack, crashing the parser (denial of service). Users are recommended
+ to upgrade to version 3.2.4, which fixes this issue.
+
+ * Credit:
+
+ This issue was found using Claude agents to study the security of
+ open-source projects (finder)
+
+ * {{{https://www.cve.org/CVERecord?id=CVE-2026-91864}CVE-2026-91864}}:
+ Apache Neethi: Crafted WS-Policy documents bypass element/attribute
+ limits causing memory exhaustion
+
+ * Severity: Moderate
+
+ * Affected versions:
+
+ - Apache Neethi (org.apache.neethi:neethi) before 3.2.4
+
+ * Description:
+
+ A specially crafted WS-Policy document can pack unlimited content
+ inside a policy assertion, which Neethi copies into memory without
+ counting it against its size limits, exhausting the heap (denial of
+ service). Users are recommended to upgrade to version 3.2.4, which
+ fixes this issue.
+
+ * Credit:
+
+ This issue was found using Claude agents to study the security of
+ open-source projects (finder)
+
+ * {{{https://www.cve.org/CVERecord?id=CVE-2026-91865}CVE-2026-91865}}:
+ Apache Neethi: Crafted policy references cause exponential expansion
+ during normalization leading to denial of service
+
+ * Severity: Moderate
+
+ * Affected versions:
+
+ - Apache Neethi (org.apache.neethi:neethi) before 3.2.4
+
+ * Description:
+
+ A small WS-Policy document using repeated policy references can force
+ Neethi to re-expand the same references exponentially during
+ normalization, consuming huge amounts of CPU and memory (denial of
+ service). Users are recommended to upgrade to version 3.2.4, which
+ fixes this issue.
+
+ * Credit:
+
+ This issue was found using Claude agents to study the security of
+ open-source projects (finder)
+
+ * {{{https://www.cve.org/CVERecord?id=CVE-2026-91866}CVE-2026-91866}}:
+ Apache Neethi: Crafted policies cause unbounded work during intersection
+ leading to denial of service
+
+ * Severity: Moderate
+
+ * Affected versions:
+
+ - Apache Neethi (org.apache.neethi:neethi) before 3.2.4
+
+ * Description:
+
+ A specially crafted pair of WS-Policy documents can force Neethi's
+ policy-intersection to do exponential amounts of work, pinning the CPU
+ for a long time (denial of service). Users are recommended to upgrade
+ to version 3.2.4, which fixes this issue.
+
+ * Credit:
+
+ This issue was found using Claude agents to study the security of
+ open-source projects (finder)
+
+ * {{{https://www.cve.org/CVERecord?id=CVE-2026-91867}CVE-2026-91867}}:
+ Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow
+ server to hang the request indefinitely
+
+ * Severity: Moderate
+
+ * Affected versions:
+
+ - Apache Neethi (org.apache.neethi:neethi) before 3.2.4
+
+ * Description:
+
+ When Neethi fetches a remote policy reference, it only limits the time
+ per read, not the whole transfer, so a server that trickles bytes slowly
+ can keep the fetch alive indefinitely and tie up the calling thread
+ (denial of service). Users are recommended to upgrade to version 3.2.4,
+ which fixes this issue.
+
+ * Credit:
+
+ This issue was found using Claude agents to study the security of
+ open-source projects (finder)
+
* {{{https://www.cve.org/CVERecord?id=CVE-2026-66144}CVE-2026-66144}}:
Apache Neethi: Remote PolicyReference fetch lacks resource bounds
diff --git a/src/site/xdoc/download.xml b/src/site/xdoc/download.xml
index a861a7f..d0c474b 100644
--- a/src/site/xdoc/download.xml
+++ b/src/site/xdoc/download.xml
@@ -32,7 +32,7 @@
<section name="Releases">
<div align="left">
- <p>Please select the Apache Neethi version you want to
download. Latest release is 3.2.3. You can download both the binary
distribution and the source distribution. All the releases are available for
download as source or binary. For more information,
+ <p>Please select the Apache Neethi version you want to
download. Latest release is 3.2.4. You can download both the binary
distribution and the source distribution. All the releases are available for
download as source or binary. For more information,
please see
<a href="https://www.apache.org/dev/release.html";>Apache
Release FAQ</a>
</p>
@@ -51,21 +51,21 @@
</tr>
<tr class="b">
<td>
- <a name="3_2_3"></a>3.2.3</td>
+ <a name="3_2_4"></a>3.2.4</td>
<td>Release</td>
- <td>Source Distribution <a
href="[preferred]/ws/neethi/3.2.3/neethi-3.2.3-source-release.zip">zip</a>
+ <td>Source Distribution <a
href="[preferred]/ws/neethi/3.2.4/neethi-3.2.4-source-release.zip">zip</a>
- <a
href="https://downloads.apache.org/ws/neethi/3.2.3/neethi-3.2.3-source-release.zip.sha256";>SHA-256</a>
- <a
href="https://downloads.apache.org/ws/neethi/3.2.3/neethi-3.2.3-source-release.zip.asc";>PGP</a>
+ <a
href="https://downloads.apache.org/ws/neethi/3.2.4/neethi-3.2.4-source-release.zip.sha256";>SHA-256</a>
+ <a
href="https://downloads.apache.org/ws/neethi/3.2.4/neethi-3.2.4-source-release.zip.asc";>PGP</a>
<br></br>
- Binary Distribution <a
href="[preferred]/ws/neethi/3.2.3/neethi-3.2.3-bin.zip">zip</a>
- <a
href="https://downloads.apache.org/ws/neethi/3.2.3/neethi-3.2.3-bin.zip.sha256";>SHA-256</a>
- <a
href="https://downloads.apache.org/ws/neethi/3.2.3/neethi-3.2.3-bin.zip.asc";>PGP</a>
+ Binary Distribution <a
href="[preferred]/ws/neethi/3.2.4/neethi-3.2.4-bin.zip">zip</a>
+ <a
href="https://downloads.apache.org/ws/neethi/3.2.4/neethi-3.2.4-bin.zip.sha256";>SHA-256</a>
+ <a
href="https://downloads.apache.org/ws/neethi/3.2.4/neethi-3.2.4-bin.zip.asc";>PGP</a>
<br></br>
</td>
- <td>April - 2026</td>
- <td>3.2.3 Release (Mirrored)</td>
+ <td>September - 2026</td>
+ <td>3.2.4 Release (Mirrored)</td>
</tr>
</tbody>
</table>
