{"id":"CVE-2026-91864","title":"A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its size limits, exhausting the heap (denial of service).\nUsers are recommended to u…","summary":"A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its size limits, exhausting the heap (denial of service).\nUsers are recommended to u…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-770"],"vendor":"Apache Software Foundation","product":"org.apache.neethi:neethi","affected":["org.apache.neethi:neethi < 3.2.4"],"published":"2026-09-21","updated":"2026-09-21","sourceUpdated":"2026-09-21T18:10:30.343","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91864","references":[{"url":"https://lists.apache.org/thread/400kbynbyhqhsjkv1yz251jm9wdz8z69","label":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/18/11","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-21T13:27:33.548043Z"},"ingestedAt":"2026-09-21T11:35:54.433Z","slug":"CVE-2026-91864","body":"## Overview\n\nA specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its size limits, exhausting the heap (denial of service).\nUsers are recommended to upgrade to version 3.2.4, which fixes this issue.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":208357,"id":"CVE-2026-91864","ts":1789997910266,"field":"cvss","old":null,"new":"7.5"},{"seq":208356,"id":"CVE-2026-91864","ts":1789997910266,"field":"severity","old":"none","new":"high"}]}