High · 7.5 CVE-2026-91863 EUVD-2026-83885GHSA-wr93-w764-3636

Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service

Published Sep 21, 2026 · Updated Sep 21, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Neethi

Description

A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread stack, crashing the parser (denial of service).
Users are recommended to upgrade to version 3.2.4, which fixes this issue.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache Neethi	< 3.2.4	3.2.4

Advisories 2

WID-SEC-2026-4410 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
WID-SEC-2026-4314 IBM WebSphere Application Server Liberty: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 9, 2026

References

https://lists.apache.org/thread/72kxj71lvrqqx90xxqqctvpbw0t8mpxw vendor-advisory