CVE-2026-91864 — Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustion

CVE-2026-91864

Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustion PUBLISHED

Description (CNA)

A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its size limits, exhausting the heap (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Neethi	affected 0 before 3.2.4

CWE

No CWE identifiers supplied.

References

https://lists.apache.org/thread/400kbynbyhqhsjkv1yz251jm9wdz8z69

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/09/18/11

CISA-ADP

No English description supplied.

No references supplied.