CVE-2026-91864

7.5 highEPSS 0.7%

High (7.5) in apache neethi. EPSS 0.7% chance of exploitation in the next 30 days.

A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its size limits, exhausting the heap (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
CWE: CWE-770
Published: 2026-09-21
Modified: 2026-09-25
Record from: the NVD, synced 2026-10-19

Affected

apache:neethi

References

https://lists.apache.org/thread/400kbynbyhqhsjkv1yz251jm9wdz8z69
http://www.openwall.com/lists/oss-security/2026/09/18/11

Check your stack JSON