CVE-2026-91866: Apache Neethi DOS Vulnerability

CVE-2026-91866 Overview

CVE-2026-91866 is a denial-of-service vulnerability in Apache Neethi, the WS-Policy processing library used across the Apache web services stack. A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection routine to perform an exponential amount of work. The resulting CPU exhaustion can pin a server process for an extended period, preventing legitimate request processing.

The issue is tracked under CWE-770: Allocation of Resources Without Limits or Throttling. Apache addressed the flaw in Neethi 3.2.4 and recommends all users upgrade. See the Apache mailing list discussion for the vendor announcement.

Critical Impact
Unauthenticated attackers can trigger sustained CPU exhaustion on any service that intersects attacker-supplied WS-Policy documents, degrading or halting SOAP-based application availability.

Affected Products

Apache Neethi versions prior to 3.2.4
Apache web services components that embed Neethi for WS-Policy processing (for example, Apache CXF and Axis2 deployments)
SOAP endpoints that accept or intersect externally supplied WS-Policy documents

Discovery Timeline

2026-09-21 - CVE-2026-91866 published to the National Vulnerability Database
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-91866

Vulnerability Analysis

Apache Neethi implements the WS-Policy specification, which defines how web services describe their capabilities and requirements. Policy intersection is the operation that combines two policies and produces the set of alternatives common to both. Neethi expands nested policy assertions into a normal form before comparing alternatives.

The intersection algorithm exhibits worst-case exponential behavior when processing deeply nested wsp:ExactlyOne and wsp:All operators. An attacker who controls even one side of the intersection can craft a compact XML document that expands into a very large alternative set. The server then spends seconds to minutes on a single request, consuming a worker thread and CPU core.

Because the attack targets an algorithmic complexity weakness rather than a memory bug, no code execution or data disclosure occurs. The impact is confined to availability, but a small number of concurrent requests can saturate a multi-core host.

Root Cause

The root cause is missing bounds on policy normalization ([CWE-770]). Neethi did not cap the number of alternatives produced during intersection nor limit the depth of nested policy operators. Version 3.2.4 introduces the required guardrails.

Attack Vector

Exploitation requires only network access to an endpoint that consumes attacker-influenced WS-Policy XML. No authentication or user interaction is required. Typical attack surfaces include SOAP endpoints that accept policy attachments in requests, WS-MetadataExchange handlers, and any service that intersects a client-provided policy against its own effective policy.

No public proof-of-concept has been published. Technical discussion is available in the Openwall oss-security post and the linked Apache thread.

Detection Methods for CVE-2026-91866

Indicators of Compromise

Sustained high CPU utilization localized to Java worker threads handling SOAP or WS-Policy processing
Request-processing latency spikes correlated with inbound SOAP traffic containing large or deeply nested wsp:Policy, wsp:ExactlyOne, or wsp:All elements
Thread dumps showing extended time in org.apache.neethi intersection or normalization methods

Detection Strategies

Inspect SOAP request bodies at the gateway for WS-Policy documents that exceed a reasonable nesting depth or element count
Alert on requests whose service-handler execution time exceeds a defined threshold (for example, five seconds) on endpoints that process WS-Policy
Correlate CPU saturation events with concurrent SOAP requests from a single source IP or client certificate

Monitoring Recommendations

Enable per-request timing metrics on Apache CXF, Axis2, or other Neethi consumers and export them to your observability stack
Baseline normal WS-Policy document sizes and flag statistical outliers for review
Track the installed Neethi version across service inventories and alert when versions below 3.2.4 appear

How to Mitigate CVE-2026-91866

Immediate Actions Required

Upgrade Apache Neethi to version 3.2.4 on every host that ships the library, including transitive dependencies inside Apache CXF and Axis2 deployments
Identify SOAP endpoints reachable from untrusted networks and place them behind an application-layer gateway that can enforce request size and complexity limits
Restrict which clients may submit WS-Policy documents by requiring authentication where feasible

Patch Information

Apache Neethi 3.2.4 fixes the intersection algorithm and is the vendor-recommended remediation. Rebuild and redeploy any application that bundles Neethi as a dependency. Confirm remediation by verifying the resolved neethi-*.jar version on the runtime classpath rather than relying solely on declared dependency versions.

Workarounds

Reject inbound SOAP requests exceeding a conservative body-size limit at the reverse proxy or API gateway
Drop or sanitize requests containing WS-Policy elements with excessive nesting of wsp:ExactlyOne or wsp:All operators
Apply per-request CPU time or wall-clock timeouts to SOAP handler threads so a single malicious request cannot monopolize a worker

bash

# Example: enforce a 2 MB request body cap and a 10s handler timeout in NGINX
client_max_body_size 2m;
proxy_read_timeout 10s;
send_timeout 10s;