CVE-2026-91867: Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitely
Apache Neethi before 3.2.4 lacks a total timeout when fetching remote policies, letting a slow server hang the request thread indefinitely.