CVE-2026-91863CWE-674

CVE-2026-91863

High · published September 21, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
54.7
In the wild
Unconfirmed
What it is

A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread stack, crashing the parser (denial of service).

Users are recommended to upgrade to version 3.2.4, which fixes this issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00758 · 54.7th percentile
Weakness
CWE-674 · Uncontrolled Recursion
Published
2026-09-21T16:17Z
Affected products (1)
ProductVersionsFixed in
apache/neethi< 3.2.43.2.4
References (2)
https://lists.apache.org/thread/72kxj71lvrqqx90xxqqctvpbw0t8mpxw · [email protected]http://www.openwall.com/lists/oss-security/2026/09/18/10 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 23 SEP 03:49Z
    EPSS moved — → 1%
    epss
  • 21 SEP 11:25Z
    Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service
    cvelistv5