Five denial-of-service flaws (CVE-2026-91863 through CVE-2026-91867) fixed in Apache Neethi 3.2.4

Apache Neethi (org.apache.neethi:neethi) before 3.2.4 is affected by five denial-of-service vulnerabilities — stack exhaustion, heap exhaustion, exponential normalization and intersection workloads, and an unbounded remote policy fetch — all fixed in version…

On 2026-09-18, five related vulnerabilities were disclosed on oss-security affecting Apache Neethi (org.apache.neethi:neethi) versions before 3.2.4, all resulting in denial of service. CVE-2026-91863 is an uncontrolled recursion flaw: a crafted WS-Policy document with deeply nested policy elements bypasses the library's nesting-depth limit, exhausting the thread stack and crashing the parser. CVE-2026-91864 allows a crafted WS-Policy document to pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its size limits, exhausting the heap. CVE-2026-91865 lets a small document using repeated policy references force exponential re-expansion during normalization, consuming large amounts of CPU and memory. CVE-2026-91866 causes the policy-intersection routine to perform an exponential amount of work on a specially crafted pair of WS-Policy documents, pinning the CPU for a long time. CVE-2026-91867 concerns remote policy fetches: Neethi limits only per-read time and not the whole transfer, so a server trickling bytes slowly can keep a fetch alive indefinitely and tie up the calling thread. The first issue (CVE-2026-91863) was disclosed by Colm O hEigeartaigh; CVE-2026-91863 through CVE-2026-91866 were reported as found using Claude agents during security analysis of the library (report 5 does not state a discovery method for CVE-2026-91867). Users are advised to upgrade to Apache Neethi 3.2.4, which fixes all five issues. The reports do not disagree on any facts.

• Affected package: Apache Neethi (org.apache.neethi:neethi), all versions before 3.2.4
• Fix: upgrade to Apache Neethi 3.2.4, which addresses all five CVEs
• CVE-2026-91863: deeply nested WS-Policy elements bypass the nesting-depth limit, causing stack exhaustion and denial of service
• CVE-2026-91864: unlimited content inside policy assertions is copied without counting against size limits, causing heap exhaustion
• CVE-2026-91865: repeated policy references trigger exponential re-expansion during normalization, consuming CPU and memory
• CVE-2026-91866: crafted pairs of WS-Policy documents cause exponential work during policy intersection, pinning the CPU
• CVE-2026-91867: remote policy fetch has a per-read timeout but no total transfer timeout, allowing a slow server to hang the request thread indefinitely