CVE-2026-91863: Apache Neethi DOS Vulnerability

CVE-2026-91863 Overview

CVE-2026-91863 is a denial-of-service vulnerability in Apache Neethi, the WS-Policy framework used by Apache Axis2 and related web services stacks. A specially crafted WS-Policy document with deeply nested policy elements bypasses Neethi's nesting-depth limit and exhausts the thread stack. The result is a parser crash that terminates the processing thread and disrupts service availability. The flaw is remotely exploitable without authentication or user interaction. Apache has released Neethi 3.2.4 to address the issue. The vulnerability is tracked under CWE-674 (Uncontrolled Recursion).

Critical Impact
Unauthenticated remote attackers can crash the WS-Policy parser thread by submitting a malformed policy document, causing denial of service to any service that consumes untrusted policy input.

Affected Products

Apache Neethi versions prior to 3.2.4
Apache Axis2 deployments that consume WS-Policy documents through Neethi
Downstream web service stacks bundling vulnerable Neethi releases

Discovery Timeline

2026-09-21 - CVE-2026-91863 published to the National Vulnerability Database (NVD)
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-91863

Vulnerability Analysis

Apache Neethi parses WS-Policy XML documents that describe requirements and capabilities for SOAP-based web services. The parser implements a nesting-depth limit intended to reject documents that recurse beyond a safe threshold. The vulnerability arises because a crafted document structure can bypass that limit, driving the parser into unchecked recursion. Each recursive call consumes thread stack space until the JVM raises a StackOverflowError and terminates the parsing thread.

Because WS-Policy is typically evaluated during service initialization or message handling, a single malicious document can disrupt request processing for legitimate clients. Attackers do not need credentials or interactive access. The flaw only impacts availability. Confidentiality and integrity remain intact.

Root Cause

The defect maps to CWE-674: Uncontrolled Recursion. Neethi's guard for nested policy elements does not account for every syntactic path a well-formed but malicious document can take. The evasion allows the recursive descent parser to continue past the intended depth ceiling, consuming stack frames until exhaustion.

Attack Vector

An attacker submits a WS-Policy document containing deeply nested policy elements to any endpoint that hands the payload to Neethi for parsing. This includes SOAP endpoints that accept inline policy attachments, policy import URIs, or configuration files reachable through administrative interfaces. When Neethi processes the payload, the parser thread crashes and the associated request or service initialization fails.

See the Apache Mailing List Thread and the OpenWall OSS-Security Update for the vendor description of the exploitation path.

Detection Methods for CVE-2026-91863

Indicators of Compromise

Repeated java.lang.StackOverflowError entries in application logs with stack frames referencing org.apache.neethi classes
Abnormally large or deeply nested WS-Policy XML payloads received by SOAP endpoints
Unexpected termination of Axis2 or Neethi worker threads during policy evaluation

Detection Strategies

Inspect inbound XML for excessive element nesting depth before it reaches the Neethi parser, using a WAF or XML gateway rule
Correlate application crash telemetry with recent inbound requests to policy-consuming endpoints
Baseline normal WS-Policy document sizes and alert on outliers submitted from untrusted clients

Monitoring Recommendations

Forward Java exception logs and application stderr into a centralized log platform for anomaly detection
Monitor JVM thread counts and uncaught exception rates on Axis2-based services
Track HTTP 5xx spikes on SOAP endpoints that accept policy documents

How to Mitigate CVE-2026-91863

Immediate Actions Required

Upgrade Apache Neethi to version 3.2.4 or later across all deployments
Inventory applications that depend on Neethi transitively through Axis2 or CXF-derived stacks and prioritize patching internet-facing services
Restrict which clients can submit WS-Policy documents to trusted, authenticated principals where feasible

Patch Information

Users should upgrade to Apache Neethi 3.2.4, which enforces the nesting-depth limit against the bypass condition. Refer to the Apache Mailing List Thread for the official vendor announcement.

Workarounds

Deploy an XML gateway or WAF policy that rejects SOAP requests containing XML nesting depth beyond an application-defined threshold
Constrain maximum request body size on endpoints that accept WS-Policy payloads to limit attacker payload space
Isolate services that must accept untrusted policy input into dedicated worker pools so crashes do not cascade

bash

# Example Maven dependency update to the fixed version
<dependency>
  <groupId>org.apache.neethi</groupId>
  <artifactId>neethi</artifactId>
  <version>3.2.4</version>
</dependency>