CVE-2026-91865

7.5 highEPSS 0.7%

High (7.5) in apache neethi. EPSS 0.7% chance of exploitation in the next 30 days.

A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
CWE: CWE-770
Published: 2026-09-21
Modified: 2026-09-25
Record from: the NVD, synced 2026-10-19

Affected

apache:neethi

References

https://lists.apache.org/thread/l48btqh02rlpsgf5p6r5ltqk1cb69dtc
http://www.openwall.com/lists/oss-security/2026/09/18/12

Check your stack JSON