CVE-2026-91865

Apache Neethi, a Java library that processes WS-Policy documents, fails to guard against exponentially expensive re-expansion of policy references during normalization. An attacker can submit a small, deliberately crafted WS-Policy document containing repeated references to the same policy, causing Neethi to re-expand those references exponentially and exhaust CPU and memory, hanging or crashing the parsing process. The attacker gains only a denial of service, not code execution or data access, but any service that parses untrusted WS-Policy input with an affected Neethi version is at risk. The issue is fixed in Apache Neethi 3.2.4, and there is no evidence of exploitation in the wild and no public proof of concept.

What to do: Upgrade Apache Neethi to 3.2.4, or force the upgraded version in your dependency tree if it arrives transitively (e.g., via your WS-SecurityPolicy/WS-* stack). If you cannot upgrade immediately, ensure your application does not normalize WS-Policy documents from untrusted or unauthenticated sources, and set CPU/memory limits or timeouts on policy parsing. Audit dependency trees for any neethi artifacts below 3.2.4.