As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-91864: Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustion
Apache Neethi versions before 3.2.4 contain a vulnerability in WS-Policy document processing that allows specially crafted documents to bypass element and attribute size limits. Attackers can exploit this to pack unlimited content into policy assertions, causing memory exhaustion and denial of service. The Apache project recommends upgrading to version 3.2.4 to remediate the issue.
Why it matters: Organizations running Apache Neethi before 3.2.4 face availability risk from denial of service attacks; apply the patch to prevent heap exhaustion from malicious WS-Policy documents.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-91864: Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustion
Apache Neethi versions before 3.2.4 are vulnerable to denial of service when processing specially crafted WS-Policy documents that bypass element and attribute size limits. Affected applications copy unlimited policy assertion content into memory without enforcing heap restrictions, enabling attackers to exhaust available memory. Version 3.2.4 addresses the flaw.
Why it matters: Organizations running Apache Neethi before 3.2.4 in web services environments face denial of service risk from unauthenticated attackers sending malformed WS-Policy documents; upgrade immediately to 3.2.4.
- Source published
- First seen by Cybersecurity Tracker