< Back

CVE-2026-91863

Updated on 21 Sep 2026

Severity

7.5 High severity

Details

CVSS score
7.5
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi’s nesting-depth limit and exhaust the thread stack, crashing the parser (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.

Details

Affected product:
Apache CXF , Wildfly , camel , chemistry-opencmis , gora , infinispan , jbossws-cxf , karaf , opencmis , trunk , ws-neethi , ws-wss4j
Affected packages:
neethi @ 3.1.1 (+2816 more)