Status: UPDATED | Advisory ID: CVE-2026-91865
| CVE | CVE-2026-91865 |
| CVSS Score / Version | 7.5 (High) / CVSS v3.1 |
| Updated | 2026-09-25 |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CVSS Prose | attack vector is network; attack complexity is low; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is none; integrity impact is none; availability impact is high. |
| Affected products | Apache neethi and Apache Software Foundation Apache Neethi |
| Classified as | CWE-770 (Allocation of Resources Without Limits or Throttling) |
| Vendor | Product | Affected Versions | Patch Status |
|---|---|---|---|
| Apache | neethi | ||
| Apache Software Foundation | Apache Neethi |
| Subsystems | General OT |
| Sectors | Multiple |
A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory (denial of service).
Users are recommended to upgrade to version 3.2.4, which fixes this issue. (NVD)
Monitor Apache's and Apache Software Foundation's web pages for any future patch releases. See vendor advisory link below.
| Source | Reference |
|---|---|
| NVD | https://nvd.nist.gov/vuln/detail/CVE-2026-91865 |
| CVE | https://www.cve.org/CVERecord?id=CVE-2026-91865 |
| Vendor advisory | https://lists.apache.org/thread/l48btqh02rlpsgf5p6r5ltqk1cb69dtc |