CVE-2026-91865: Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service

Apache Neethi, a Java library that processes WS-Policy documents, fails to guard against exponentially expensive re-expansion of policy references during normalization. An attacker can submit a small, deliberately crafted WS-Policy document containing repeated references to the same policy, causing Neethi to re-expand those references exponentially and exhaust CPU and memory, hanging or crashing the parsing process. The attacker gains only a denial of service, not code execution or data access, but any service that parses untrusted WS-Policy input with an affected Neethi version is at risk. The issue is fixed in Apache Neethi 3.2.4, and there is no evidence of exploitation in the wild and no public proof of concept.