High · 7.5 CVE-2026-91864 EUVD-2026-83886GHSA-cw6x-vx7r-8x4q

Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustion

Published Sep 21, 2026 · Updated Sep 21, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Neethi

Description

A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its size limits, exhausting the heap (denial of service).
Users are recommended to upgrade to version 3.2.4, which fixes this issue.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache Neethi	< 3.2.4	3.2.4

Advisories 2

WID-SEC-2026-4410 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
WID-SEC-2026-4314 IBM WebSphere Application Server Liberty: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 9, 2026

References

https://lists.apache.org/thread/400kbynbyhqhsjkv1yz251jm9wdz8z69 vendor-advisory