CVE-2026-91866: Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of service

Q: What does an attacker need to exploit this issue?

The attacker needs to supply a specially crafted pair of WS-Policy documents that will be processed together by Neethi's policy-intersection functionality.

Q: What is the impact of successful exploitation?

Processing the crafted policies can cause exponential work during policy intersection, pinning CPU resources for a long time and resulting in denial of service.

Q: What version addresses the issue?

Upgrade Apache Neethi to version 3.2.4, which fixes this issue.

Published Sep 18, 2026

Updated

A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU for a long time (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.

Affected Software

1 affected component

Apache Neethi<=3.2.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Neethi to a version that resolves this vulnerability.
Fixed in 3.2.4Patch CVE-2026-91866

Event History

Sep 21, 2026

CVE Published

via MITRE·11:27 AM

Data Sourced

via MITRE·11:27 AM

Description

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attacker needs to supply a specially crafted pair of WS-Policy documents that will be processed together by Neethi's policy-intersection functionality.

What is the impact of successful exploitation?

Processing the crafted policies can cause exponential work during policy intersection, pinning CPU resources for a long time and resulting in denial of service.

What version addresses the issue?