Status: UPDATED | Advisory ID: CVE-2026-91866
| CVE | CVE-2026-91866 |
| CVSS Score / Version | 7.5 (High) / CVSS v3.1 |
| Updated | 2026-09-25 |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CVSS Prose | attack vector is network; attack complexity is low; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is none; integrity impact is none; availability impact is high. |
| Affected products | Apache neethi and Apache Software Foundation Apache Neethi |
| Classified as | CWE-770 (Allocation of Resources Without Limits or Throttling) |
| Vendor | Product | Affected Versions | Patch Status |
|---|---|---|---|
| Apache | neethi | ||
| Apache Software Foundation | Apache Neethi |
| Subsystems | General OT |
| Sectors | Multiple |
A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU for a long time (denial of service).
Users are recommended to upgrade to version 3.2.4, which fixes this issue. (NVD)
Monitor Apache's and Apache Software Foundation's web pages for any future patch releases. See vendor advisory link below.
| Source | Reference |
|---|---|
| NVD | https://nvd.nist.gov/vuln/detail/CVE-2026-91866 |
| CVE | https://www.cve.org/CVERecord?id=CVE-2026-91866 |
| Vendor advisory | https://lists.apache.org/thread/zbfxnomgvbmqchqjgc6lk5h0z76k3gh4 |