As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-91863: Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service
Apache Neethi before version 3.2.4 contains an uncontrolled recursion vulnerability in its WS-Policy document parser that can be triggered by specially crafted documents with deeply nested policy elements. An attacker can exploit this flaw to exhaust the thread stack and crash the parser, resulting in denial of service. The vendor has released version 3.2.4 to address the issue.
Why it matters: Organizations running Apache Neethi before 3.2.4 in web service environments should upgrade immediately to prevent attackers from crashing their policy parsing services with malicious WS-Policy documents.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-91863: Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service
Apache Neethi before version 3.2.4 contains a denial of service (DoS) vulnerability in its WS-Policy document parser. Specially crafted documents with deeply nested policy elements can bypass the nesting-depth limit and exhaust thread stack resources, causing the parser to crash. The vendor recommends upgrading to version 3.2.4 to resolve the issue.
Why it matters: Organizations running Apache Neethi in production for web services policy handling must upgrade to 3.2.4 to prevent attackers from triggering DoS conditions through malicious WS-Policy documents.
- Source published
- First seen by Cybersecurity Tracker