> CVE-2026-91864

« BACK_TO_HOME
PUBLISHED
2026-09-21 12:17
MODIFIED
2026-09-21 12:17
EPSS (Prob. Exploit)
0.74%
Top 46.2%
DATA SOURCES:
NVD 🔗 2026-09-21 RED HAT 🔗 2026-09-27 FIRST EPSS 🔗 2026-10-21 OSV 🔗 2026-10-19

> DESCRIPTION

A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its size limits, exhausting the heap (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> RED HAT SEVERITY ASSESSMENT

THREAT SEVERITY
Important

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustion

AFFECTED PACKAGES:
Unknown / Unknown
71 versions affected

> HISTORIQUE DES MODIFICATIONS

Première apparition
21/09/2026 12:17
Source: NVD
📊 ENRICHISSEMENT 27/09/2026 05:02
REDHAT
Champ modifié: Sévérité Red Hat
Ancienne valeur:
N/A
Nouvelle valeur:
{ "threat_severity": "Important", "severity_scale": null }
📊 ENRICHISSEMENT 27/09/2026 05:02
REDHAT
Champ modifié: Red Hat
Ancienne valeur:
Non
Nouvelle valeur:
Oui
Total des modifications: 2 Dernière mise à jour: 3 weeks ago

> REFERENCES

https://lists.apache.org/thread/400kbynbyhqhsjkv1yz251jm9wdz8z69
« BACK_TO_HOME