Apache MyFaces DoS and SSRF/LFI disclosures joined by Apache Neethi recursion DoS (CVE-2026-76646, CVE-2026-68536, CVE-2026-91863)

Apache MyFaces disclosed a critical request-parsing denial-of-service flaw (CVE-2026-76646) and a moderate SSRF/local file inclusion flaw (CVE-2026-68536) across its maintained branches on 2026-09-16; two days later, CVE-2026-91863 revealed an…

Three Apache vulnerabilities were disclosed on oss-security between 2026-09-16 and 2026-09-18. On 2026-09-16, the Apache MyFaces team disclosed CVE-2026-76646, a critical remote denial-of-service vulnerability in which attackers supply specially crafted request parameters to trigger excessive resource consumption; the root cause is unbounded request parsing. Affected versions are 2.2.0-2.2.15, 2.3.0-2.3.11, 3.0.0-3.0.3, 4.0.0-4.0.3, 4.1.0-4.1.3 and 2.3-next-*, with older versions possibly impacted as well, and the disclosure describes the vulnerability as fixed. The same day, the team disclosed CVE-2026-68536, a moderate-severity server-side request forgery and local file inclusion vulnerability in the MyFaces JSF implementation (org.apache.myfaces.core:myfaces-impl), affecting the maintained 2.2.*, 2.3.*, 3.0.*, 4.0.*, 4.1.* and 2.3-next-* branches; that disclosure provided no exploitation details or patch status. On 2026-09-18, Colm O hEigeartaigh disclosed CVE-2026-91863, an uncontrolled-recursion flaw in Apache Neethi (org.apache.neethi:neethi) in all versions before 3.2.4. A crafted WS-Policy document with deeply nested policy elements bypasses the library's nesting-depth limit, exhausting the thread stack and crashing the parser, resulting in denial of service. Users are advised to upgrade to Apache Neethi 3.2.4. The Neethi flaw was found using Claude agents during security analysis of the code. No exploitation has been reported for the MyFaces vulnerabilities, and the Neethi disclosure did not report any exploitation either.