CVE-2026-91863: Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service

Apache Neethi, the Java library used to parse WS-Policy documents in SOAP web-service stacks, fails to properly enforce its nesting-depth limit, allowing a specially crafted WS-Policy document with deeply nested policy elements to trigger uncontrolled recursion and exhaust the thread stack, crashing the parser. An attacker who can get a vulnerable application to parse a malicious policy document — for example a SOAP service that processes untrusted WS-Policy attachments or fetched WSDL/policy files — gains a denial-of-service condition only; there is no indication of code execution or data exposure. Any application embedding a Neethi version older than 3.2.4 is affected, and because Neethi is usually pulled in as a transitive dependency of frameworks such as Apache CXF, Axis2, and WSS4J, many maintainers may not realize they ship it. There is no public proof of concept, the issue is not in the CISA Known Exploited Vulnerabilities catalog, and no exploitation in the wild has been reported.