CVE-2026-91863: Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service
Apache Neethi before 3.2.4 suffers denial of service via deeply nested WS-Policy documents that exhaust the parser's thread stack (CVE-2026-91863).
Colm O hEigeartaigh disclosed CVE-2026-91863, an uncontrolled recursion flaw in Apache Neethi (org.apache.neethi:neethi) versions before 3.2.4. A crafted WS-Policy document with deeply nested policy elements bypasses the library's nesting-depth limit, exhausting the thread stack and crashing the parser. The flaw was found using Claude agents during security analysis of the code. Users are advised to upgrade to version 3.2.4.
- Deeply nested WS-Policy elements bypass Neethi's nesting-depth limit
- Stack exhaustion crashes the parsing thread, causing denial of service
- Fixed in Apache Neethi 3.2.4; all earlier versions affected
- Issue discovered using Claude agents for security analysis
- CVEs
- CVE-2026-91863
- Vendors
- Apache
- Products
- Apache Neethi
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-91863 | Stack-exhaustion DoS in Apache Neethi WS-Policy parser (fixed in 3.2.4) | 7.5 | — |
From the original article
Posted by Colm O hEigeartaigh on Sep 18 Severity: moderate Affected versions: - Apache Neethi (org. apache. neethi:neethi) before 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.