CVE-2026-91865: Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service
Apache Neethi before 3.2.4 exponentially re-expands repeated policy references during normalization, enabling CPU and memory exhaustion attacks.
CVE-2026-91865 affects Apache Neethi (org.apache.neethi:neethi) versions before 3.2.4. A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming large amounts of CPU and memory and causing denial of service. Users should upgrade to version 3.2.4. The issue was found using Claude agents.
- Fix released in Apache Neethi 3.2.4
- Exponential expansion from repeated policy references in normalization
- Discovered using Claude agents during security research
- CVEs
- CVE-2026-91865
- Vendors
- Apache Software Foundation
- Products
- Apache Neethi
- AI models
- Claude
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-91865 | Exponential Expansion Denial of Service in Apache Neethi WS-Policy Normalization | 7.5 | — |
From the original article
Posted by Colm O hEigeartaigh on Sep 18 Severity: moderate Affected versions: - Apache Neethi (org. apache. neethi:neethi) before 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.