CVE-2026-91863 Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service

A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread stack, crashing the parser denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

CVE-2026-91863 Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service

A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread stack, crashing the parser denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

CVE-2026-91863

A flaw exists in Apache Neethi where a remote attacker can send a specially crafted WS-Policy document containing deeply nested policy elements. This document can bypass the parser's nesting-depth limit, triggering uncontrolled recursion that exhausts the thread stack and crashes the parser, resu...

CVE-2026-91866: Allocation of Resources Without Limits or Throttling

A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU for a long time denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

CVE-2026-91865: Allocation of Resources Without Limits or Throttling

A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

PT-2026-96080

Name of the Vulnerable Software and Affected Versions Neethi versions prior to 3.2.4 Description A specially crafted WS-Policy document containing deeply nested policy elements can bypass the nesting-depth limit. This leads to thread stack exhaustion, which crashes the parser and results in a...

PT-2026-96081

Name of the Vulnerable Software and Affected Versions Neethi versions prior to 3.2.4 Description A specially crafted WS-Policy document allows for unlimited content to be packed inside a policy assertion. Neethi copies this content into memory without applying size limits, leading to heap...

CVE-2026-91864: Allocation of Resources Without Limits or Throttling

A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its size limits, exhausting the heap denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

CVE-2026-91863: Uncontrolled Recursion

A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread stack, crashing the parser denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

PT-2026-96082

Name of the Vulnerable Software and Affected Versions Neethi versions prior to 3.2.4 Description A small WS-Policy document using repeated policy references can force the software to re-expand the same references exponentially during normalization. This process consumes excessive CPU and memory,...

Exploit for Missing Authentication for Critical Function in Coreweave Marimo

CVE-2026-39987 — Marimo WebSocket RCE PoC Proof of Concept fo...

DEBIAN-CVE-2026-91147

A flaw was found in cockpit-ws. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by sending a specially crafted request. When the WebService.UrlRoot is configured and a request is made to the exact URL-root prefix without a trailing slash, cockpit-ws c...

CVE-2026-91147

A flaw was found in cockpit-ws. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by sending a specially crafted request. When the WebService.UrlRoot is configured and a request is made to the exact URL-root prefix without a trailing slash, cockpit-ws c...

UBUNTU-CVE-2026-91147

A flaw was found in cockpit-ws. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by sending a specially crafted request. When the WebService.UrlRoot is configured and a request is made to the exact URL-root prefix without a trailing slash, cockpit-ws c...

CVE-2026-91147

A flaw was found in cockpit-ws. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by sending a specially crafted request. When the WebService.UrlRoot is configured and a request is made to the exact URL-root prefix without a trailing slash, cockpit-ws c...

CVE-2026-91147

A flaw was found in cockpit-ws. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by sending a specially crafted request. When the WebService.UrlRoot is configured and a request is made to the exact URL-root prefix without a trailing slash, cockpit-ws c...

CVE-2026-91147 Cockpit: cockpit: denial of service in `cockpit-ws` due to url-root handling without a trailing slash

A flaw was found in cockpit-ws. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by sending a specially crafted request. When the WebService.UrlRoot is configured and a request is made to the exact URL-root prefix without a trailing slash, cockpit-ws c...

EUVD-2026-83175

A flaw was found in cockpit-ws. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by sending a specially crafted request. When the WebService.UrlRoot is configured and a request is made to the exact URL-root prefix without a trailing slash, cockpit-ws c...

CVE-2026-91147 Cockpit: cockpit: denial of service in `cockpit-ws` due to url-root handling without a trailing slash

A flaw was found in cockpit-ws. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by sending a specially crafted request. When the WebService.UrlRoot is configured and a request is made to the exact URL-root prefix without a trailing slash, cockpit-ws c...

CVE-2026-91147

A denial-of-service flaw was identified in cockpit-ws , the web service component of Cockpit . When WebService.UrlRoot is configured, a remote, unauthenticated attacker can cause cockpit-ws to terminate unexpectedly by sending a request to the exact URL-root prefix without a trailing slash . The ...