CVE Feed

    Dashboard / CVE / CVE-2026-91863

    CVE-2026-91863

    A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread stack, crashing the parser (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.

    Published:Sep 21, 2026
    Last Modified:Sep 24, 2026
    EPS:Sep 21, 2026
    EPSS Score:0.00533
    CVSS Score:7.5

    Affected Products

    Vendor
    Apache
    Product
    Neethi

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-230 Serialized Data with Nested Payloads
    CAPEC-231 Oversized Serialized Data Payloads

    Related CVEs

    CVE-2026-91867 (CVSS 4.3) — When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a …
    CVE-2026-91866 (CVSS 7.5) — A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amoun…
    CVE-2026-91865 (CVSS 7.5) — A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references …
    CVE-2026-91864 (CVSS 7.5) — A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copi…
    CVE-2026-66144 (CVSS 7.5) — Although remote policy references are not retrieved during policy normalization, if they are manually retrieve…
    CVE-2026-66143 (CVSS 7.5) — It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Ne…
    CVE-2026-66142 (CVSS 7.5) — Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deepl…
    CVE-2026-42404 (CVSS 6.5) — Apache Neethi does not impose any restrictions on URIs when manually fetching remote policy references through…
    CVE-2026-42402 (CVSS 7.5) — Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalizati…
    CVE-2026-42403 (CVSS 7.5) — Apache Neethi does not properly detect circular references in policy definitions. When a WS-Policy document co…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High