Denial of Service Vulnerability in Neethi by Apache
CVE-2026-91865

Currently unrated

Key Information:

Vendor: Apache
Status: Apache Neethi
Vendor: CVE Published:; 21 September 2026

What is CVE-2026-91865?

A vulnerability in Neethi allows for Denial of Service attacks due to a weakness in handling WS-Policy documents. Specifically, repeated policy references can lead to exponential re-expansion during normalization, resulting in excessive CPU and memory consumption. This issue can severely degrade or halt system performance, making it critical for users to apply preventive measures. Users should upgrade to version 3.2.4 to mitigate this risk.

Affected Version(s)

Apache Neethi 0 < 3.2.4

References

https://lists.apache.org/thread/l48btqh02rlpsgf5p6r5ltqk1...

vendor-advisory

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Sep 21, 2026
Vulnerability Reserved
Sep 15, 2026

Credit

This issue was found using Claude agents to study the security of open-source projects

CVE-2026-91865 Data

JSON