CVE-2026-91867: Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitely

<p>Posted by Colm O hEigeartaigh on Sep 18</p>Severity: moderate <br /> <br /> Affected versions:<br /> <br /> - Apache Neethi (org.apache.neethi:neethi) before 3.2.4<br /> <br /> Description:<br /> <br /> When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server <br /> that trickles bytes slowly can keep the fetch alive indefinitely and t