Vulnerability details

CVE-2026-91863

Apache Software Foundation Apache Neethi

Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service

CVSS 3.1

7.5High

Official description

A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread stack, crashing the parser (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.

CVSS scores

Score	Version	Source	Vector
7.5High	3.1	CISA ADP / Vulnrichment (CISA-ADP)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

Affected products

Vendor	Product	Versions	Source
Apache Software Foundation	Apache Neethi	v < 3.2.4	CVEProject cvelistV5 (CNA)

References and advisories

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-09-21
Last updated: 2026-09-21
State: Published
Assigner (CNA): apache

Exploit prediction (EPSS)

0.75%

Probability of exploitation in 30 days

55.4%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: None
Technical impact: Partial

Weaknesses (CWE)

CWE-674
Uncontrolled Recursion