CVE-2026-91863

7.5 HIGH

Published 2026-09-21 · Updated 2026-09-24

AI risk analysis

Summary: The flaw allows a specially crafted WS-Policy document to exhaust the thread stack, causing a denial of service. This matters because it can disrupt service without requiring sophisticated exploitation.
Exploitability: Exploitation requires sending a complex WS-Policy document; preconditions include using an affected version of Neethi.
Blast radius: If exploited, this could lead to service disruption for systems relying on the affected parser.
Prioritized remediation: Upgrade to Neethi version 3.2.4 immediately to address this issue.

dosxmlpolicyparser

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread stack, crashing the parser (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-674

Vendors

apache

Products

neethi

References

https://lists.apache.org/thread/72kxj71lvrqqx90xxqqctvpbw0t8mpxw Mailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/09/18/10 Mailing List, Third Party Advisory

Data: NVD (public domain). Analysis: local $0 model. Defensive use only.