CVE-2026-42404

Medium

Published: 01 May 2026

Published

01 May 2026

Modified

01 May 2026

KEV Added

—

Patch

—

CVSS Score 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS Score 0.0003 10.5th percentile

Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-42404 is a medium-severity SSRF (CWE-918) vulnerability in Apache Neethi. Its CVSS base score is 6.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 10.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Timely flaw remediation by upgrading Apache Neethi to version 3.2.2 directly eliminates the SSRF vulnerability in the PolicyReference API.

SI-10 Information Input Validation good match

prevent

Validates URI inputs to the PolicyReference API to enforce restrictions on protocols and addresses, preventing arbitrary outbound requests.

SC-7 Boundary Protection good match

prevent

Boundary protection devices monitor and control outbound communications to block requests to internal IP addresses and unauthorized protocols.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1018 Remote System Discovery Discovery

Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.

attack.mitre.org →

T1046 Network Service Discovery Discovery

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation.

attack.mitre.org →

Why these techniques?

SSRF vulnerability in public-facing app library directly enables T1190 via crafted URI input; facilitates internal IP/port probing for T1018 Remote System Discovery and T1046 Network Service Discovery.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

Apache Neethi does not impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API. When an application explicitly calls the API to retrieve a policy from a remote URI, an outbound request is made for…

arbitrary protocols and internal IP adddresses. From 3.2.2, only http or https URIs are allowed, and link-local/multicast/any-local addresses are forbidden. Users are recommended to upgrade to version 3.2.2, which fixes this issue.

Deeper analysisAI

Apache Neethi, a Java library for WS-Policy processing, contains a vulnerability in versions prior to 3.2.2 where the PolicyReference API does not impose restrictions on URIs during manual fetches of remote policy references. This allows applications explicitly calling the API to make outbound requests to arbitrary protocols and internal IP addresses, including link-local, multicast, or any-local addresses. The issue is classified as CWE-918 (Server-Side Request Forgery) with a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).

Remote attackers can exploit this vulnerability by tricking applications into invoking the PolicyReference API with a specially crafted URI, such as one targeting internal network resources or unsupported protocols. No authentication or user interaction is required, enabling network-accessible exploitation with low complexity. Successful attacks can result in limited confidentiality and integrity impacts, such as unauthorized access to internal services or data leakage via SSRF.

Apache advisories recommend upgrading to version 3.2.2, which restricts URIs to HTTP or HTTPS only and forbids link-local, multicast, and any-local addresses. Relevant discussions are available in the Apache mailing list announcement and oss-security mailing list post.