CVE-2026-91864CWE-770denial-of-service

CVE-2026-91864

High · published September 21, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
54.1
In the wild
Unconfirmed
What it is

A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its size limits, exhausting the heap (denial of service).

Users are recommended to upgrade to version 3.2.4, which fixes this issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00740 · 54.1th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-09-21T16:17Z
Affected products (1)
ProductVersionsFixed in
apache/neethi< 3.2.43.2.4
References (2)
https://lists.apache.org/thread/400kbynbyhqhsjkv1yz251jm9wdz8z69 · [email protected]http://www.openwall.com/lists/oss-security/2026/09/18/11 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 23 SEP 03:49Z
    EPSS moved — → 1%
    epss
  • 21 SEP 11:26Z
    Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustion
    cvelistv5