CVE-2026-91867

Name of the Vulnerable Software and Affected Versions Neethi versions prior to 3.2.4

Description An issue exists when fetching a remote policy reference where the system only limits the time per read rather than the entire transfer. A malicious server can send bytes slowly to keep the fetch operation active indefinitely, which ties up the calling thread and leads to a denial of service (a condition where a system becomes unavailable to its intended users).

Recommendations Upgrade to version 3.2.4.