CVE-2026-66143 is a denial of service vulnerability in Apache Neethi where crafted policies can bypass the limit on the maximum number of normalized policy alternatives introduced in version 3.2.2. This bypass leads to uncontrolled resource consumption, impacting availability. The vulnerability affects all versions prior to 3.2.3. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability. No known exploits in the wild have been reported. The vendor recommends upgrading to version 3.2.3, which fixes the issue.

Successful exploitation can cause denial of service by exhausting system resources due to uncontrolled resource consumption when processing specially crafted policies. There is no impact on confidentiality or integrity reported.

Upgrade Apache Neethi to version 3.2.3 or later, which contains the fix for this vulnerability. No other mitigation or temporary workaround is indicated.