CVE-2026-91865 — Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service
A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU a…
Published: 2026-09-21 · CVSS: 7.5 · CVSS 3.1
A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7