Five denial-of-service flaws (CVE-2026-91863 through CVE-2026-91867) fixed in Apache Neethi 3.2.4

Apache Neethi (org.apache.neethi:neethi) before 3.2.4 is affected by five denial-of-service vulnerabilities — stack exhaustion, heap exhaustion, exponential normalization and intersection workloads, and an unbounded remote policy fetch — all fixed in version…

On 2026-09-18, five related vulnerabilities were disclosed on oss-security affecting Apache Neethi (org.apache.neethi:neethi) versions before 3.2.4, all resulting in denial of service. CVE-2026-91863 is an uncontrolled recursion flaw: a crafted WS-Policy document with deeply nested policy elements bypasses the library's nesting-depth limit, exhausting the thread stack and crashing the parser. CVE-2026-91864 allows a crafted WS-Policy document to pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its size limits, exhausting the heap. CVE-2026-91865 lets a small document using repeated policy references force exponential re-expansion during normalization, consuming large amounts of CPU and memory. CVE-2026-91866 causes the policy-intersection routine to perform an exponential amount of work on a specially crafted pair of WS-Policy documents, pinning the CPU for a long time. CVE-2026-91867 concerns remote policy fetches: Neethi limits only per-read time and not the whole transfer, so a server trickling bytes slowly can keep a fetch alive indefinitely and tie up the calling thread. The first issue (CVE-2026-91863) was disclosed by Colm O hEigeartaigh; CVE-2026-91863 through CVE-2026-91866 were reported as found using Claude agents during security analysis of the library (report 5 does not state a discovery method for CVE-2026-91867). Users are advised to upgrade to Apache Neethi 3.2.4, which fixes all five issues. The reports do not disagree on any facts.