AIKIDO-2026-10685
neethi is vulnerable to Server-Side Request Forgery (SSRF)
65
Medium Risk
This Affects:
neethiTL;DR
Improper validation of remote policy reference URIs in Apache Neethi allows unrestricted outbound requests when applications manually fetch policies via the PolicyReference API. This can lead to a server-side request forgery (SSRF) vulnerability by permitting arbitrary protocols and access to internal or restricted IP addresses. Starting from 3.2.2, URI handling is restricted to http and https protocols, and link-local, multicast, and any-local addresses are blocked.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
neethi is vulnerable to Server-Side Request Forgery (SSRF) in versions 0.0.1 - 3.2.1.
How to fix this
Upgrade the org.apache.neethi:neethi library to the patch version.
Links
github.com/apache/ws-neethi/compare/neethi-3.2.1...neethi-3.2.2
lists.apache.org/thread/zdspnt64zznyjyn648553kptx69w23oqopenwall.com/lists/oss-security/2026/05/01/8
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant