CVE-2026-91865CWE-770denial-of-service

CVE-2026-91865

High · published September 21, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
54.1
In the wild
Unconfirmed
What it is

A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory (denial of service).

Users are recommended to upgrade to version 3.2.4, which fixes this issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00740 · 54.1th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-09-21T16:17Z
Affected products (1)
ProductVersionsFixed in
apache/neethi< 3.2.43.2.4
References (2)
https://lists.apache.org/thread/l48btqh02rlpsgf5p6r5ltqk1cb69dtc · [email protected]http://www.openwall.com/lists/oss-security/2026/09/18/12 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 23 SEP 03:49Z
    EPSS moved — → 1%
    epss
  • 21 SEP 11:26Z
    Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service
    cvelistv5