AIKIDO-2026-10685
neethi is vulnerable to Server-Side Request Forgery (SSRF)
65
Medium Risk
This Affects:
neethiTL;DR
Improper validation of remote policy reference URIs in Apache Neethi allows unrestricted outbound requests when applications manually fetch policies via the PolicyReference API. This can lead to a server-side request forgery (SSRF) vulnerability by permitting arbitrary protocols and access to internal or restricted IP addresses. Starting from 3.2.2, URI handling is restricted to http and https protocols, and link-local, multicast, and any-local addresses are blocked.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
neethi is vulnerable to Server-Side Request Forgery (SSRF) in versions 0.0.1 - 3.2.1.
How to fix this
Upgrade the org.apache.neethi:neethi library to the patch version.
Links
github.com/apache/ws-neethi/compare/neethi-3.2.1...neethi-3.2.2
lists.apache.org/thread/zdspnt64zznyjyn648553kptx69w23oqopenwall.com/lists/oss-security/2026/05/01/8
Get Secure Now
Secure your code, cloud, and runtime environments in one central system. Find and fix vulnerabilities automatically.
No credit card required | Scan results in 32secs.
SOC 2Compliant
ISO 27001Compliant