High · 7.5 CVE-2026-91865 EUVD-2026-83887GHSA-6vm6-6w33-f874

Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service

Published Sep 21, 2026 · Updated Sep 21, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Neethi

Description

A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory (denial of service).
Users are recommended to upgrade to version 3.2.4, which fixes this issue.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache Neethi	< 3.2.4	3.2.4

Advisories 3

WID-SEC-2026-4410 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
WID-SEC-2026-4314 IBM WebSphere Application Server Liberty: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 9, 2026
WID-SEC-2026-4320 IBM WebSphere Application Server: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Nov 5, 2026

References

https://lists.apache.org/thread/l48btqh02rlpsgf5p6r5ltqk1cb69dtc vendor-advisory