CVE-2026-91867: Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitely

Apache Neethi, a Java library for processing WS-Policy documents, applies a timeout to each individual read when fetching a remotely referenced policy, but sets no deadline on the transfer as a whole. A malicious or compromised policy server can exploit this by trickling bytes just fast enough to keep resetting the per-read timer, holding the fetch open indefinitely and permanently tying up the calling application's thread, which is a denial of service. Exploitation requires an application built on a vulnerable Neethi version to resolve a policy from an attacker-controlled or attacker-influenced URL, so the impact depends on how the library is used rather than on Neethi alone. The flaw is fixed in Apache Neethi 3.2.4. There is no known public proof of concept, no evidence of exploitation in the wild, and the CVE is not in CISA's KEV catalog.