Denial Of Service

Neethi is vulnerable to Denial of Service. The vulnerability is due to exponential re-expansion of repeated policy references during normalization, where the same references are re-expanded exponentially consuming huge amounts of CPU and memory, and attackers can supply a crafted WS-Policy docume...

Heap Exhaustion

Neethi is vulnerable to heap exhaustion. The vulnerability is due to Neethi copying a WS-Policy document into memory without enforcing size limits, where a specially crafted WS-Policy document can pack unlimited content inside a policy assertion and attackers can trigger heap exhaustion, leading ...

Stack Exhaustion DoS

Neethi is vulnerable to Stack Exhaustion DoS. The vulnerability is due to bypassing Neethi's nesting-depth limit, where a specially crafted WS-Policy document with deeply nested policy elements can exhaust the thread stack and crash the parser, causing a denial of service...

RHLW-2026-5E3F8CCB11A37BA5 Lightwell Security Advisory: neethi 3.2.2.rhlw-00028

Red Hat Lightwell has released org.apache.neethi:neethi 3.2.2.rhlw-00028 with backported fixes for CVE-2026-91863, CVE-2026-91865, CVE-2026-91866, and CVE-2026-91867. CVE-2026-91863: Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service...

CVE-2026-91866

A flaw was found in Neethi. A remote attacker could exploit this vulnerability by providing specially crafted WS-Policy documents. This could force Neethi's policy-intersection to perform an exponential amount of work, leading to a denial of service DoS by consuming excessive CPU resources...

CVE-2026-91865

A flaw was found in Apache Neethi. A remote attacker could exploit this vulnerability by providing a specially crafted WS-Policy document containing repeated policy references. This document would force Neethi to exponentially re-expand the same references during normalization, consuming excessiv...

CVE-2026-91864

A flaw was found in Apache Neethi. A remote attacker could exploit this vulnerability by sending a specially crafted WS-Policy document. This document can contain unlimited content within a policy assertion, which Neethi processes without proper size limits. This can lead to memory exhaustion,...

CVE-2026-91863

A flaw was found in Apache Neethi. A remote attacker could exploit this vulnerability by sending a specially crafted WS-Policy document containing deeply nested policy elements. This crafted document can bypass the parser's nesting-depth limit, leading to uncontrolled recursion that exhausts the...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion through the parsing process of WS-Policy documents containing deeply nested policy elements. An attacker can cause the application to exhaust the thread stack and crash the parser by submitting specially crafted...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the policy-intersection. An attacker can exhaust system resources and cause service disruption by submitting specially crafted WS-Policy documents that trigger excessive...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the processing of WS-Policy documents containing excessive content within policy assertions. An attacker can cause memory exhaustion by submitting specially crafted documents...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the normalization. An attacker can exhaust system resources by submitting a specially crafted WS-Policy document containing repeated policy references that trigger exponential...

CVE-2026-91866

A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU for a long time denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

CVE-2026-91863

A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread stack, crashing the parser denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

CVE-2026-91864

A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its size limits, exhausting the heap denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

CVE-2026-91865

A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

CVE-2026-91866 Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of service

A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU for a long time denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

CVE-2026-91866

Apache Neethi is vulnerable to a denial of service (DoS) condition due to a flaw in its policy-intersection functionality. A remote attacker can provide a specially crafted pair of WS-Policy documents that force the system to perform an exponential amount of work, resulting in excessive CPU consu...

CVE-2026-91866 Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of service

A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU for a long time denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

CVE-2026-91866

A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU for a long time denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...