Apache Neethi before 3.2.4 lacks a total timeout when fetching remote policies, letting a slow server hang the request thread indefinitely.
Apache Neethi before 3.2.4 performs exponential work during policy intersection on crafted WS-Policy pairs, causing CPU-pinning denial of service.
Apache Neethi before 3.2.4 exponentially re-expands repeated policy references during normalization, enabling CPU and memory exhaustion attacks.
Apache Neethi before 3.2.4 copies unlimited content inside policy assertions without size checks, allowing crafted documents to exhaust the heap.
Apache Neethi before 3.2.4 suffers denial of service via deeply nested WS-Policy documents that exhaust the parser's thread stack (CVE-2026-91863).
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.
Today 1.6K readers · 2.4K views · 776 reads · all time 189K views