CVE-2026-91866: Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of service
A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU for a long time (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Neethito a version that resolves this vulnerability.Fixed in 3.2.4Patch CVE-2026-91866
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs to supply a specially crafted pair of WS-Policy documents that will be processed together by Neethi's policy-intersection functionality.
What is the impact of successful exploitation?
Processing the crafted policies can cause exponential work during policy intersection, pinning CPU resources for a long time and resulting in denial of service.
What version addresses the issue?
Upgrade Apache Neethi to version 3.2.4, which fixes this issue.