CVE-2026-91866: Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of service

Apache Neethi, a Java library that parses and processes WS-Policy documents, is vulnerable to an algorithmic-complexity denial of service in its policy-intersection logic. An attacker who can supply two specially crafted WS-Policy documents that the application intersects can force Neethi to perform exponential amounts of work, pinning the CPU for an extended period and degrading or exhausting service availability. Practical risk is highest for applications that accept policy documents from untrusted sources, such as SOAP/WS-* web service endpoints that process client-supplied policies. All users of Neethi prior to the fixed release are affected; the issue is resolved in version 3.2.4. There is no public proof of concept, the flaw is not in CISA's Known Exploited Vulnerabilities catalog, and no exploitation has been reported.