CVE-2026-91865: Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service

Q: What does an attacker need to exploit this issue?

An attacker needs to supply a crafted WS-Policy document containing repeated policy references that is processed and normalized by Apache Neethi. The document can be small while causing exponential re-expansion of references.

Q: What is the impact of successful exploitation?

Normalization can consume very large amounts of CPU and memory, resulting in denial of service.

Q: What version fixes the issue?

Upgrade Apache Neethi to version 3.2.4, which fixes the exponential expansion during normalization.

Published Sep 18, 2026

Updated

A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.

Affected Software

1 affected component

Apache Neethi<=3.2.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Neethi to a version that resolves this vulnerability.
Fixed in 3.2.4Patch CVE-2026-91865

Event History

Sep 21, 2026

CVE Published

via MITRE·11:26 AM

Data Sourced

via MITRE·11:26 AM

Description

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker needs to supply a crafted WS-Policy document containing repeated policy references that is processed and normalized by Apache Neethi. The document can be small while causing exponential re-expansion of references.

What is the impact of successful exploitation?

Normalization can consume very large amounts of CPU and memory, resulting in denial of service.

What version fixes the issue?

Upgrade Apache Neethi to version 3.2.4, which fixes the exponential expansion during normalization.

CVE-2026-91865: Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service

Affected Software

Remediation

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the impact of successful exploitation?

What version fixes the issue?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the impact of successful exploitation?

What version fixes the issue?