Status: UPDATED | Advisory ID: CVE-2026-91864
| CVE | CVE-2026-91864 |
| CVSS Score / Version | 7.5 (High) / CVSS v3.1 |
| Updated | 2026-09-25 |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CVSS Prose | attack vector is network; attack complexity is low; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is none; integrity impact is none; availability impact is high. |
| Affected products | Apache neethi and Apache Software Foundation Apache Neethi |
| Classified as | CWE-770 (Allocation of Resources Without Limits or Throttling) |
| Vendor | Product | Affected Versions | Patch Status |
|---|---|---|---|
| Apache | neethi | ||
| Apache Software Foundation | Apache Neethi |
| Subsystems | General OT |
| Sectors | Multiple |
A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its size limits, exhausting the heap (denial of service).
Users are recommended to upgrade to version 3.2.4, which fixes this issue. (NVD)
Monitor Apache's and Apache Software Foundation's web pages for any future patch releases. See vendor advisory link below.
| Source | Reference |
|---|---|
| NVD | https://nvd.nist.gov/vuln/detail/CVE-2026-91864 |
| CVE | https://www.cve.org/CVERecord?id=CVE-2026-91864 |
| Vendor advisory | https://lists.apache.org/thread/400kbynbyhqhsjkv1yz251jm9wdz8z69 |