CVE-2026-91864

HighCVSS 7.5/10Last modified Sep 25, 2026

Description

A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its size limits, exhausting the heap (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Neethi	< 3.2.4

References

https://lists.apache.org/thread/400kbynbyhqhsjkv1yz251jm9wdz8z69Mailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/09/18/11Mailing List, Third Party Advisory

Timeline

Published: Sep 21, 2026
Last modified: Sep 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-918657.5A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normaliza CVE-2026-918667.5A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU fo CVE-2026-918674.3When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slo CVE-2026-918686.5IBM Security QRadar EDR 3.12 through 3.12.26 could allow a remote authenticated attacker to obtain sensitive information due to improper acc CVE-2026-918698.1IBM Security QRadar EDR 3.12 through 3.12.26 could allow a remote authenticated attacker to bypass security restrictions due to improper rat CVE-2026-91875.3The Abandoned Contact Form 7 plugin for WordPress is vulnerable to unauthorized arbitrary post deletion in versions up to, and including, 2.CVE-2026-918707.4Dell Ansible Storage for PowerFlex, versions prior to 3.2.0, contains an Improper Certificate Validation vulnerability in the API client com CVE-2026-918717.4Dell Ansible Storage for PowerStore, versions prior to 3.9.0, contains an Improper Certificate Validation vulnerability in the API client co CVE-2026-918725.5Dell Ansible Storage for PowerStore, versions prior to 3.9.0,contains an Insertion of Sensitive Information into Log File vulnerability in t CVE-2026-918738.7Dell OpenManage Ansible Modules, versions 2.1.2 through 10.0.3, contains an Improper Certificate Validation vulnerability in the iDRACRedfis CVE-2026-918748.7Dell OpenManage Ansible Modules, versions 5.0.0 through 10.0.3, contains an Improper Certificate Validation vulnerability in the iDRACConnec CVE-2026-918758.7Dell OpenManage Ansible Modules, versions 9.2.0 through 10.0.3, contains an Improper Certificate Validation vulnerability in the SessionAPI