Red Hat Lightwell has released org.apache.neethi:neethi 3.2.1.rhlw-00003 with a backported security fix.
CVE-2026-42402: Apache Neethi: Policy Normalization Unbounded Resource Allocation DoS
This patched artifact is a drop-in replacement for org.apache.neethi:neethi 3.2.1 from Maven Central.