CVE-2026-91864: Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustion
Apache Neethi before 3.2.4 copies unlimited content inside policy assertions without size checks, allowing crafted documents to exhaust the heap.
CVE-2026-91864 affects Apache Neethi (org.apache.neethi:neethi) versions before 3.2.4. A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its size limits, exhausting the heap and causing denial of service. Users should upgrade to version 3.2.4. The issue was found using Claude agents.
- Fix released in Apache Neethi 3.2.4
- Size-limit bypass enables heap exhaustion via crafted assertions
- Discovered using Claude agents during security research
- CVEs
- CVE-2026-91864
- Vendors
- Apache Software Foundation
- Products
- Apache Neethi
- AI models
- Claude
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-91864 | Heap Exhaustion DoS in Apache Neethi WS-Policy Parser (fixed in 3.2.4) | 7.5 | — |
From the original article
Posted by Colm O hEigeartaigh on Sep 18 Severity: moderate Affected versions: - Apache Neethi (org. apache. neethi:neethi) before 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.