CVE-2026-91865
published 2026-09-21CVE-2026-91865: A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming…
PriorityP340high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.74%
54.2th percentile
A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory (denial of service).
Users are recommended to upgrade to version 3.2.4, which fixes this issue.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | neethi | < 3.2.4 | 3.2.4 |
| apache | neethi | — | — |
| apache_software_foundation | apache_neethi | < 3.2.4 | 3.2.4 |
| jboss-eap-7 | eap74-els-openjdk11-openshift-rhel8 | — | — |
| jboss-eap-7 | eap74-els-openjdk17-openshift-rhel8 | — | — |
| jboss-eap-7 | eap74-els-openjdk8-openshift-rhel8 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory (denial of se
ghsa_unreviewed·2026-09-21
CVE-2026-91865 [HIGH] CWE-770 A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory (denial of se
A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory (denial of service).
Users are recommended to upgrade to version 3.2.4, which fixes this issue.
Red Hat
org.apache.neethi/neethi: Apache Neethi: Denial of Service via crafted WS-Policy documents
vendor_redhat·2026-09-21·CVSS 7.5
CVE-2026-91865 [HIGH] CWE-776 org.apache.neethi/neethi: Apache Neethi: Denial of Service via crafted WS-Policy documents
org.apache.neethi/neethi: Apache Neethi: Denial of Service via crafted WS-Policy documents
A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory (denial of service).
Users are recommended to upgrade to version 3.2.4, which fixes this issue.
A flaw was found in Apache Neethi. A remote attacker could exploit this vulnerability by providing a specially crafted WS-Policy document containing repeated policy references. This document would force Neethi to exponentially re-expand the same references during normalization, consuming excessive CPU and memory resources. This can lead to a denial of service (DoS), making the affected system unavailable to legitimate us
No detection rules found.
No public exploits indexed.
2026-09-21
Published