As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-91866: Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of service
Apache Neethi versions before 3.2.4 contain a vulnerability in policy-intersection logic that allows crafted WS-Policy documents to trigger exponential CPU consumption, causing denial of service. The moderate-severity issue was identified through automated analysis and is addressed in version 3.2.4.
Why it matters: Teams running Apache Neethi in web services environments should upgrade to 3.2.4 immediately to prevent attackers from exhausting CPU resources with malformed policy documents.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-91866: Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of service
CVE-2026-91866 affects Apache Neethi versions before 3.2.4, where specially crafted WS-Policy documents trigger exponential computational work during policy intersection, causing denial of service. The vulnerability has a CVSS score of 7.5. Upgrade to version 3.2.4 to remediate.
Why it matters: Organizations running Apache Neethi in production for WS-Policy processing should prioritize upgrading to 3.2.4 to prevent attackers from exhausting CPU resources via crafted policy documents.
- Source published
- First seen by Cybersecurity Tracker