{"id":"CVE-2026-91863","title":"A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread stack, crashing the parser (denial of service).\nUsers are recommended to upgrade to version 3.2.4, w…","summary":"A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread stack, crashing the parser (denial of service).\nUsers are recommended to upgrade to version 3.2.4, w…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-674","CWE-835"],"vendor":"apache","product":"neethi","affected":["neethi < 3.2.4"],"patched":["neethi 3.2.4"],"published":"2026-09-21","updated":"2026-09-24","sourceUpdated":"2026-09-24T20:34:14.977","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91863","references":[{"url":"https://lists.apache.org/thread/72kxj71lvrqqx90xxqqctvpbw0t8mpxw","label":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/18/10","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91863.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-91863"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2538446"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-91863"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91863"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.00758,"epssPercentile":0.55019,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-21T13:35:51.992035Z"},"ingestedAt":"2026-09-21T11:35:54.434Z","slug":"CVE-2026-91863","body":"## Overview\n\nA specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread stack, crashing the parser (denial of service).\nUsers are recommended to upgrade to version 3.2.4, which fixes this issue.\n\n## Affected\n\n- `neethi < 3.2.4`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `neethi 3.2.4`\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat Single Sign-On 7 · no fix planned: Red Hat JBoss Enterprise Application Platform 7, Red Hat Single Sign-On 7, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4, … · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91863.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[{"seq":208415,"id":"CVE-2026-91863","ts":1790001584819,"field":"cvss","old":null,"new":"7.5"},{"seq":208414,"id":"CVE-2026-91863","ts":1790001584819,"field":"severity","old":"none","new":"high"}]}