CVE-2026-91863: Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service
A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread stack, crashing the parser (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Neethito a version that resolves this vulnerability.Fixed in 3.2.4Patch CVE-2026-91863
Event History
Frequently Asked Questions
Who can trigger this denial of service?
An attacker who can cause Apache Neethi to parse a WS-Policy document can trigger the issue by supplying a specially crafted document with deeply nested policy elements.
What happens during exploitation?
The crafted nesting bypasses Neethi's nesting-depth limit and exhausts the parser thread's stack, causing the parser to crash and resulting in denial of service.
What version fixes the issue?
Upgrade Apache Neethi to version 3.2.4, which fixes this vulnerability.