CVE-2026-91863
📛 CVE Title
Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service
Description
A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread stack, crashing the parser (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- apache
- CVSS severity
- —
- CVSS score
- —
- CVSS vector
- —
- Effective score
- 7.5 / 10 HIGH source: NVD
- CWE(s)
- —
- Reserved
- 2026-09-15
- Published
- 2026-09-21 11:25 UTC
- Last updated
- 2026-09-21 13:36 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91863.json
- Linked Threat
- CVE-2026-91863 — Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-09-21 12:17:24 UTC
- NVD last modified
- 2026-09-21 18:10:30 UTC
- NVD CVSS v3.1
- 7.5 / 10 HIGH source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
- NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- Exploitability subscore
- 3.9 / 10
- Impact subscore
- 3.6 / 10
NVD-assigned CWE(s):
CWE-674
(differs from the CNA list above)
NVD / KEV / EPSS data refreshed 2026-09-22 03:24 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-83885 - Assigner
- apache
- Published
- Sep 21, 2026, 11:25:26 AM
- Updated
- Sep 21, 2026, 1:36:42 PM
- EUVD base score (CVSS 3.1)
-
7.5 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - EUVD-reported EPSS
- 0.0000
- Vendors
- Apache Software Foundation
- Products
-
Apache Neethi (0 <3.2.4)
- Aliases
-
GHSA-wr93-w764-3636
ENISA description: A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread stack, crashing the parser (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.
EUVD references (1)
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Apache Software Foundation | Apache Neethi |
0 (affected)
|
— |
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
- https://lists.apache.org/thread/72kxj71lvrqqx90xxqqctvpbw0t8mpxw vendor-advisory
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
NVD-tagged references (2)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- http://www.openwall.com/lists/oss-security/2026/09/18/10 af854a3a-2127-422b-91ae-364da2661108
- https://lists.apache.org/thread/72kxj71lvrqqx90xxqqctvpbw0t8mpxw security@apache.org
Remediations (10)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:avd.aquasec.com
CVE-2026-91863 Vulnerability, Severity 0 N/A, Uncontrolled Recursion Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure ...
2026-09-22 16:45 UTC -
web:cvetodo.com
CVE-2026-91863 is a Denial of Service vulnerability in Apache Neethi. Full technical analysis, mitigations , and exploit status — updated in real time.
2026-09-22 16:45 UTC -
web:patchmypc.com
You can find the production release history below for 2026 . View the 2025 Catalog Release History.
2026-09-22 16:45 UTC -
web:patchstack.com
WordPress 7.0.3 landed on 6 August 2026 . It's a security release with 12 different fixes covering pre-auth cross-site scripting (XSS), stored XSS, privilege esc
2026-09-22 16:45 UTC -
web:vulners.com
CVE-2026-91863 🗓️ 21 Sep 2026 04:25:26 Reported by apache Type cve 🔗 web.nvd.nist.gov 👁 12 Views
2026-09-22 16:45 UTC -
web:www.cisecurity.org
Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could allow for arbitrary code execution. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete ...
2026-09-22 16:45 UTC -
web:www.oracle.com
This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.
2026-09-22 16:45 UTC -
web:www.oracle.com
This Critical Patch Update contains 1448 new security patches across the product families listed below. Please note that a My Oracle Support (MOS) note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at July 2026 Critical Patch Update: Executive Summary and Analysis.
2026-09-22 16:45 UTC -
web:www.rapid7.com
CVE-2026-91863 : Apache Software Foundation Apache Neethi: A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and…. View severity, references, and remediation details from Rapid7.
2026-09-22 16:45 UTC -
web:www.vulnpedia.com
CVE-2026-91863 : A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread stack, crashi
2026-09-22 16:45 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-91863.json.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-09-21T12:14:30.467Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/18/10"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-91863",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T13:35:51.992035Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674 Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T13:36:42.505Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.neethi:neethi",
"product": "Apache Neethi",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "3.2.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was found using Claude agents to study the security of open-source projects"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread stack, crashing the parser (denial of service).<br>Users are recommended to upgrade to version 3.2.4, which fixes this issue."
}
],
"value": "A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread stack, crashing the parser (denial of service).\nUsers are recommended to upgrade to version 3.2.4, which fixes this issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T11:25:26.648Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/72kxj71lvrqqx90xxqqctvpbw0t8mpxw"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-91863",
"datePublished": "2026-09-21T11:25:26.648Z",
"dateReserved": "2026-09-15T09:50:54.325Z",
"dateUpdated": "2026-09-21T13:36:42.505Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}