Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the normalization. An attacker can exhaust system resources by submitting a specially crafted WS-Policy document containing repeated policy references that trigger exponential...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the processing of WS-Policy documents containing excessive content within policy assertions. An attacker can cause memory exhaustion by submitting specially crafted documents...

CVE-2026-91866

A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU for a long time denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

CVE-2026-91863

A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread stack, crashing the parser denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

CVE-2026-91865

A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

CVE-2026-91864

A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its size limits, exhausting the heap denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

CVE-2026-91866

Apache Neethi is vulnerable to a denial of service (DoS) condition due to a flaw in its policy-intersection functionality. A remote attacker can provide a specially crafted pair of WS-Policy documents that force the system to perform an exponential amount of work, resulting in excessive CPU consu...

EUVD-2026-83888

A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU for a long time denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

CVE-2026-91866 Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of service

A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU for a long time denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

CVE-2026-91866 Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of service

A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU for a long time denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

CVE-2026-91866 Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of service

A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU for a long time denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

CVE-2026-91865 Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service

A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

CVE-2026-91865 Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service

A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

CVE-2026-91865

A flaw in Apache Neethi allows a remote attacker to cause a denial of service (DoS) by providing a specially crafted WS-Policy document . The vulnerability is triggered when the document contains repeated policy references , forcing Neethi to re-expand these references exponentially during normal...

EUVD-2026-83887

A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

EUVD-2026-83886

A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its size limits, exhausting the heap denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

CVE-2026-91864 Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustion

A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its size limits, exhausting the heap denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

CVE-2026-91864 Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustion

A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its size limits, exhausting the heap denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

CVE-2026-91864

Apache Neethi is vulnerable to a denial of service (DoS) condition due to insufficient input validation during the processing of WS-Policy documents . A specially crafted document can pack unlimited content within a policy assertion , which the software copies into memory without enforcing size l...

CVE-2026-91864 Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustion

A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its size limits, exhausting the heap denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...