CVE-2026-91865: Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service
A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Neethito a version that resolves this vulnerability.Fixed in 3.2.4Patch CVE-2026-91865
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to supply a crafted WS-Policy document containing repeated policy references that is processed and normalized by Apache Neethi. The document can be small while causing exponential re-expansion of references.
What is the impact of successful exploitation?
Normalization can consume very large amounts of CPU and memory, resulting in denial of service.
What version fixes the issue?
Upgrade Apache Neethi to version 3.2.4, which fixes the exponential expansion during normalization.