CVE-2026-91864: Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustion
Published Sep 18, 2026
·Updated
A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its size limits, exhausting the heap (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.
Affected Software
4 affected components
Apache Neethi<3.2.4
Apache Neethi<3.2.4
IBM App Connect Operator<=CD: 12.1.0 - 12.21.0
12.0 LTS: 12.0.0 - 12.0.28
13 LTS: 13.0.0 - 13.6.0
IBM App Connect EnterpriseCertified Containers Operands<=CD: 12.0.11.1-r1 - 12.0.12.5-r1, 13.0.1.0-r1 - 13.0.6.2-r1
12.0 LTS: 12.0.12-r1 - 12.0.12-r28
13 LTS: 13.0.7.0-r1 - 13.0.9.0-r1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Neethito a version that resolves this vulnerability.Fixed in 3.2.4Patch CVE-2026-91864
Event History
Sep 21, 2026
CVE Published
via MITRE·11:26 AM
Data Sourced
via MITRE·11:26 AM
Description
Data Sourced
via NVD·12:17 PM
DescriptionSeverityWeaknessAffected Software
Sep 22, 2026
Data Sourced
via Red Hat·10:00 PM
DescriptionSeverityAffected Software
Nov 9, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Frequently Asked Questions
1
What input must an attacker control to trigger the denial of service?
The attacker must be able to supply a specially crafted WS-Policy document containing unlimited content within a policy assertion.
2
Are configured element and attribute size limits sufficient protection?
No. The crafted content is copied into memory without being counted against Neethi's element and attribute size limits, so those limits can be bypassed.
3
What version fixes the issue?
Upgrade Apache Neethi to version 3.2.4.