Not rated
CVE-2026-91866 A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of…
Description
A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU for a long time (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Neethi 3.2 | earliest → < 3.2.4 | 3.2.4 |
References
- lists.apache.org lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache Neethi
The 11 CVEs of Apache Neethi →
CVE-2026-91867
When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server…
Not rated
CVE-2026-91865
A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references…
Not rated
CVE-2026-91864
A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into…
Not rated
CVE-2026-91863
A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and…
Not rated