CVE-2026-91866: Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of service
Apache Neethi before 3.2.4 performs exponential work during policy intersection on crafted WS-Policy pairs, causing CPU-pinning denial of service.
CVE-2026-91866 affects Apache Neethi (org.apache.neethi:neethi) versions before 3.2.4. A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection routine to perform an exponential amount of work, pinning the CPU for a long time and causing denial of service. Users are advised to upgrade to version 3.2.4. The issue was found using Claude agents studying library security.
- Fix released in Apache Neethi 3.2.4
- Exponential workload via crafted WS-Policy pair intersection
- Discovered using Claude agents during security research
- CVEs
- CVE-2026-91866
- Vendors
- Apache Software Foundation
- Products
- Apache Neethi
- AI models
- Claude
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-91866 | CPU Denial of Service in Apache Neethi via Crafted WS-Policy Intersection | 7.5 | — |
From the original article
Posted by Colm O hEigeartaigh on Sep 18 Severity: moderate Affected versions: - Apache Neethi (org. apache. neethi:neethi) before 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.