CVE-2026-91863: Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service
Apache Neethi before 3.2.4 suffers denial of service via deeply nested WS-Policy documents that exhaust the parser's thread stack (CVE-2026-91863).