CVE-2026-91863 — Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service
A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread stack, crashing the parser (denial of se…
Published: 2026-09-21 · CVSS: 7.5 · CVSS 3.1
A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread stack, crashing the parser (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7