WebSphere Application Server Liberty: Uncontrolled Resource Consumption (CVE-2026-66143)

Weakness-Klassen (CWE)

• CWE-400Class

  Uncontrolled Resource Consumption

  The product does not properly control the allocation and maintenance of a limited resource.

  cwe.mitre.org →

Re-Analyse & Statuswechsel

Chronologie der NVD-Audit-Events für diese CVE — Reanalyses, CVSS-Updates, CPE-Diffs.

1. Initial Analysis2026-07-27 14:35 UTC· nvd@nist.gov
   • CPE Configuration: OR *cpe:2.3:a:apache:neethi:3.2.2:*:*:*:*:*:*:*
   • Reference Type: Apache Software Foundation: https://lists.apache.org/thread/s6o6p5pvcbcsk54dlg6j699t5gxol28w Types: Mailing List, Vendor Advisory
   • Reference Type: CVE: http://www.openwall.com/lists/oss-security/2026/07/24/9 Types: Mailing List, Third Party Advisory
2. CVE Modified2026-07-24 15:19 UTC· af854a3a-2127-422b-91ae-364da2661108
   • Reference: http://www.openwall.com/lists/oss-security/2026/07/24/9
3. New CVE Received2026-07-24 13:18 UTC· security@apache.org
   • Affected: Apache Neethi
   • Description: It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain crafted policies, which may lead to a denial of service attack via resource consumption. Users are recommended to upgrade to version 3.2.3, which fixes this issue.
   • CWE: CWE-400
   • Reference: https://lists.apache.org/thread/s6o6p5pvcbcsk54dlg6j699t5gxol28w

Betroffene Produkte

Aus der Hersteller-/CERT-Meldung extrahierte Produkte und Versionsbereiche. Ein Version-Range wie „<4.14.6“ impliziert die Update-Empfehlung „auf 4.14.6 oder höher aktualisieren“.

• IBM

  WebSphere Application Server Liberty< 26.0.0.10

  gefixt in 26.0.0.10

• IBM

  WebSphere Application Server Liberty< 26.0.0.9

  gefixt in 26.0.0.9

Quellen & Referenzen

• https://lists.apache.org/thread/s6o6p5pvcbcsk54dlg6j699t5gxol28w
  vendor-advisory
• http://www.openwall.com/lists/oss-security/2026/07/24/9