Security Bulletin
Summary
IBM Tivoli Netcool Configuration Manager version 6.4.2 addresses multiple vulnerabilities in Apache Neethi. These vulnerabilities could allow attackers to cause a denial of service through specially crafted WS-Policy documents or malicious policy references. Exploitation may result in excessive resource consumption, application crashes, or unauthorized outbound requests, impacting service availability.
Vulnerability Details
CVEID: CVE-2026-42404
DESCRIPTION: Apache Neethi does not impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API. When an application explicitly calls the API to retrieve a policy from a remote URI, an outbound request is made for arbitrary protocols and internal IP adddresses. From 3.2.2, only http or https URIs are allowed, and link-local/multicast/any-local addresses are forbidden.
Users are recommended to upgrade to version 3.2.2, which fixes this issue.
CWE: CWE-918: Server-Side Request Forgery (SSRF)
CVSS Source: NVD
CVSS Base score: 7.2
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)
CVEID: CVE-2026-42402
DESCRIPTION: Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalization. Specially crafted WS-Policy documents can trigger an exponential Cartesian cross-product expansion during the normalization process, causing unbounded memory allocation that exhausts the JVM heap. This occurs when the normalization process generates an excessive number of policy alternatives without bounds, leading to runtime memory exhaustion.
Users should upgrade to 3.2.2 which limits the maximum number of normalized policy alternatives.
CWE: CWE-400: Uncontrolled Resource Consumption
CVSS Source: security@apache.org
CVSS Base score: 7.5
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVEID: CVE-2026-42403
DESCRIPTION: Apache Neethi does not properly detect circular references in policy definitions. When a WS-Policy document contains circular policy references (where Policy A references Policy B which references Policy A), the policy normalization process can enter an infinite loop or cause excessive recursion, leading to a stack overflow or application hang. An attacker can craft malicious policy documents with circular references to cause a Denial of Service condition
Users are recommended to upgrade to version 3.2.2, which fixes this issue.
CWE: CWE-400: Uncontrolled Resource Consumption
CVSS Source: security@apache.org
CVSS Base score: 7.5
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected Products and Versions
| Affected Product(s) | Version(s) |
| IBM Tivoli Netcool Configuration Manager(ITNCM) | 6.4.2 GA through 6.4.2.24 |
Remediation/Fixes
# Neethi Library Upgrade - Customer Note
## Affected Products and Versions
| Affected Product(s) | Version(s) |
| IBM Tivoli Netcool Configuration Manager(ITNCM) | 6.4.2 GA through 6.4.2.24 |
## Remediation/Fixes
Note:
a. If ITNCM is running on an older fix pack, it must first be upgraded to FP24, as this patch is intended to be applied only on top of ITNCM FP24.
b. This patch needs to be applied on all presentation and standalone/linked worker servers.
c. Please use the users with which ncm is installed for applying this patch.
* Replace $JAZZ_PATH in the instructions below with the Jazz Path
directory for your installation (e.g. /opt/IBM/JazzSM).
1. Download the new library version from maven repository:
- neethi-3.2.2.jar (https://mvnrepository.com/artifact/org.apache.neethi/neethi/3.2.2)
2. Back up the existing libraries by copying them to a safe location:
cp $JAZZ_PATH/profile/installedApps/JazzSMNode01Cell/Intelliden\ R-Series.ear/SOAP-API.war/WEB-INF/lib/neethi-3.2.0.jar <backup_location>/
cp $JAZZ_PATH/profile/installedApps/JazzSMNode01Cell/Intelliden\ R-Series.ear/SOAP-API.war/webstart/neethi-3.2.0.jar <backup_location>/
cp $JAZZ_PATH/profile/installedApps/JazzSMNode01Cell/Intelliden\ R-Series.ear/ICOSClient.war/WEB-INF/lib/neethi-3.2.0.jar <backup_location>/
3. Stop all running ITNCM processes by using the "itncm.sh stop" command:
$INSTALL_DIR/bin/itncm.sh stop
4. Copy the new neethi-3.2.2.jar to the following locations:
cp neethi-3.2.2.jar $JAZZ_PATH/profile/installedApps/JazzSMNode01Cell/Intelliden\ R-Series.ear/SOAP-API.war/WEB-INF/lib/
cp neethi-3.2.2.jar $JAZZ_PATH/profile/installedApps/JazzSMNode01Cell/Intelliden\ R-Series.ear/SOAP-API.war/webstart/
cp neethi-3.2.2.jar $JAZZ_PATH/profile/installedApps/JazzSMNode01Cell/Intelliden\ R-Series.ear/ICOSClient.war/WEB-INF/lib/
5. Remove the old neethi-3.2.0.jar from all locations:
rm -rf $JAZZ_PATH/profile/installedApps/JazzSMNode01Cell/Intelliden\ R-Series.ear/SOAP-API.war/WEB-INF/lib/neethi-3.2.0.jar
rm -rf $JAZZ_PATH/profile/installedApps/JazzSMNode01Cell/Intelliden\ R-Series.ear/SOAP-API.war/webstart/neethi-3.2.0.jar
rm -rf $JAZZ_PATH/profile/installedApps/JazzSMNode01Cell/Intelliden\ R-Series.ear/ICOSClient.war/WEB-INF/lib/neethi-3.2.0.jar
6. Restart ITNCM by using the "itncm.sh start" command:
$INSTALL_DIR/bin/itncm.sh start
To roll back to the previous version of the jar, please stop ITNCM as mentioned in step 3 and restore the backups that you made in step 2 to all the locations mentioned in step 4, remove the newer version of the library which was earlier copied in step 4, then perform step 6 to start ITNCM again.
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
References
Acknowledgement
Change History
31 Jul 2026: Initial Publication
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY. In addition to other efforts to address potential vulnerabilities, IBM periodically updates the record of components contained in our product offerings. As part of that effort, if IBM identifies previously unidentified packages in a product/service inventory, we address relevant vulnerabilities regardless of CVE date. Inclusion of an older CVEID does not demonstrate that the referenced product has been used by IBM since that date, nor that IBM was aware of a vulnerability as of that date. We are making clients aware of relevant vulnerabilities as we become aware of them. "Affected Products and Versions" referenced in IBM Security Bulletins are intended to be only products and versions that are supported by IBM and have not passed their end-of-support or warranty date. Thus, failure to reference unsupported or extended-support products and versions in this Security Bulletin does not constitute a determination by IBM that they are unaffected by the vulnerability. Reference to one or more unsupported versions in this Security Bulletin shall not create an obligation for IBM to provide fixes for any unsupported or extended-support products or versions.
Document Location
Worldwide
Was this topic helpful?
Document Information
Modified date:
31 July 2026
Initial Publish date:
31 July 2026
UID
ibm17282102