CVE-2026-91866

7.5 HIGH

Published 2026-09-21 · Updated 2026-09-25

AI risk analysis

Summary: The flaw involves a denial of service vulnerability in Neethi's policy-intersection due to improperly handled WS-Policy documents, leading to excessive CPU usage.
Exploitability: Exploitation requires a specially crafted pair of WS-Policy documents and is considered moderate difficulty given the specific conditions needed.
Blast radius: If exploited, this could significantly impact system performance, potentially disrupting services for all users.
Prioritized remediation: Upgrade to Neethi version 3.2.4 to address the vulnerability.

dosws-policyneethi

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU for a long time (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-770

Vendors

apache

Products

neethi

References

https://lists.apache.org/thread/zbfxnomgvbmqchqjgc6lk5h0z76k3gh4 Mailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/09/18/13 Mailing List, Third Party Advisory

Data: NVD (public domain). Analysis: local $0 model. Defensive use only.