< Back

CVE-2026-91866

Updated on 21 Sep 2026

Severity

7.5 High severity

Details

CVSS score
7.5
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

A specially crafted pair of WS-Policy documents can force Neethi’s policy-intersection to do exponential amounts of work, pinning the CPU for a long time (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.

Details

Affected product:
Apache CXF , Wildfly , camel , chemistry-opencmis , gora , infinispan , jbossws-cxf , karaf , opencmis , trunk , ws-neethi , ws-wss4j
Affected packages:
neethi @ 3.1.1 (+2816 more)