CVE-2026-91864: Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustion

Apache Neethi, a Java library used to parse WS-Policy documents in SOAP/WS-* web service stacks, fails to enforce its element and attribute size limits on content nested inside a policy assertion. An attacker who can supply a specially crafted WS-Policy document (for example, an untrusted WSDL or policy attachment fed to a service that parses it with Neethi) can cause the library to copy unlimited content into memory, exhausting the heap. The result is denial of service — application slowdown or crash from out-of-memory conditions — with no indication of code execution or data exposure. Any application embedding a Neethi version prior to 3.2.4 is affected, which most commonly means enterprise SOAP stacks and products that bundle the library transitively. There is no public proof of concept, the flaw is not in CISA's KEV catalog, and no exploitation has been reported.