CVE-2026-91863

7.5 highEPSS 0.8%

High (7.5) in apache neethi. EPSS 0.8% chance of exploitation in the next 30 days.

A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread stack, crashing the parser (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 55% of CVEs (scores of 2026-10-31)
CWE: CWE-674
Published: 2026-09-21
Modified: 2026-09-24
Record from: the NVD, synced 2026-10-19

Affected

apache:neethi

References

https://lists.apache.org/thread/72kxj71lvrqqx90xxqqctvpbw0t8mpxw
http://www.openwall.com/lists/oss-security/2026/09/18/10

Check your stack JSON