CVE-2026-91865: Apache Neethi DOS Vulnerability

CVE-2026-91865 Overview

CVE-2026-91865 is a denial-of-service vulnerability in Apache Neethi, the WS-Policy processing library used by Apache Web Services projects. A crafted WS-Policy document containing repeated policy references forces Neethi to re-expand the same references exponentially during normalization. This behavior consumes disproportionate amounts of CPU and memory relative to input size. The flaw maps to [CWE-770] Allocation of Resources Without Limits or Throttling. Apache addressed the issue in Neethi 3.2.4.

Critical Impact
A small, network-delivered WS-Policy document can exhaust server CPU and memory, rendering SOAP and web service endpoints unresponsive without any authentication.

Affected Products

Apache Neethi versions prior to 3.2.4
Apache web services stacks that depend on Neethi for WS-Policy normalization
SOAP endpoints that accept externally supplied WS-Policy documents

Discovery Timeline

2026-09-21 - CVE-2026-91865 published to the National Vulnerability Database
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-91865

Vulnerability Analysis

Apache Neethi normalizes WS-Policy documents by resolving <wsp:PolicyReference> elements into their referenced policies. When the same reference appears multiple times, or when references form nested chains, the normalization routine re-expands each occurrence independently. An attacker can craft a compact document whose expanded form grows exponentially with the number of references.

The unchecked expansion produces an algorithmic complexity attack. A policy document of a few kilobytes can generate expanded structures consuming gigabytes of heap and saturating CPU cores. The condition qualifies as an [CWE-770] resource allocation failure because Neethi imposes no cap on expansion depth, breadth, or resulting object count.

The attack requires no privileges or user interaction. Any endpoint that parses attacker-influenced WS-Policy input is exposed. Confidentiality and integrity are unaffected; availability is the sole impact.

Root Cause

Neethi's normalization logic recursively resolves policy references without memoization or cycle detection. Repeated references to the same policy identifier are treated as distinct expansions, causing combinatorial growth in the intermediate representation.

Attack Vector

An unauthenticated remote attacker submits a malicious WS-Policy document to any service that invokes Neethi normalization. This includes SOAP requests carrying inline policy assertions and services that ingest external policy definitions during handshake or configuration exchange. Sustained requests amplify the effect and can take a service cluster offline. Refer to the Apache Mailing List Discussion and the Openwall OSS-Security Update for the disclosure details.

Detection Methods for CVE-2026-91865

Indicators of Compromise

Sudden and sustained CPU saturation on Java processes hosting Apache web services with Neethi on the classpath
Rapid heap growth culminating in OutOfMemoryError entries in application logs during SOAP request handling
Inbound SOAP or WS-Policy payloads containing many <wsp:PolicyReference> elements referencing the same URI

Detection Strategies

Inspect HTTP request bodies at the web application firewall for WS-Policy documents with high counts of repeated PolicyReference URIs
Correlate JVM garbage collection pressure and thread CPU time with inbound request identifiers to isolate offending clients
Alert on Neethi stack frames appearing in long-running thread dumps captured during availability incidents

Monitoring Recommendations

Track request latency and error rates on SOAP endpoints and alert on sustained deviations
Enable JVM heap and CPU telemetry with per-endpoint tagging to identify resource spikes tied to policy parsing
Log source IP, request size, and processing duration for every WS-Policy submission to support post-incident analysis

How to Mitigate CVE-2026-91865

Immediate Actions Required

Upgrade Apache Neethi to version 3.2.4 across all affected services and rebuild dependent artifacts
Inventory web service deployments for transitive dependencies on Neethi using build tooling such as mvn dependency:tree
Restrict acceptance of externally supplied WS-Policy documents on internet-facing endpoints until patching completes

Patch Information

Apache Neethi 3.2.4 fixes the exponential expansion behavior. Update the org.apache.neethi:neethi coordinate in Maven or Gradle build files and redeploy any application that bundles Neethi. Verify the runtime classpath resolves to 3.2.4 and not an older cached version.

Workarounds

Enforce request size limits on SOAP endpoints to constrain the maximum accepted policy document
Deploy WAF rules that reject WS-Policy payloads with more than a small threshold of PolicyReference elements
Isolate WS-Policy processing behind rate limiting and circuit breakers to contain resource exhaustion

bash

# Example Maven dependency pin for the fixed release
# pom.xml
# <dependency>
#   <groupId>org.apache.neethi</groupId>
#   <artifactId>neethi</artifactId>
#   <version>3.2.4</version>
# </dependency>
mvn -U dependency:tree | grep neethi