CVE-2026-91867: Apache Neethi DOS Vulnerability

CVE-2026-91867 Overview

CVE-2026-91867 is a denial-of-service vulnerability in Apache Neethi, a WS-Policy framework used by Apache web services stacks. When Neethi resolves a remote policy reference, it enforces only a per-read socket timeout rather than a bound on the total transfer duration. A malicious HTTP server can trickle bytes slowly enough to reset the read timer indefinitely, keeping the fetch alive and blocking the calling thread. Repeated exploitation exhausts worker threads and degrades service availability. The issue is tracked under CWE-400 (Uncontrolled Resource Consumption). Users are advised to upgrade to Apache Neethi 3.2.4.

Critical Impact
Remote attackers can tie up service threads indefinitely by serving policy documents at arbitrarily slow rates, producing sustained denial of service without authentication.

Affected Products

Apache Neethi versions prior to 3.2.4
Applications and frameworks that invoke Neethi to resolve remote WS-Policy references
Downstream Apache web-services components that transitively load remote policies through Neethi

Discovery Timeline

2026-09-21 - CVE-2026-91867 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-91867

Vulnerability Analysis

Apache Neethi parses and normalizes WS-Policy assertions used by SOAP and other Apache web-services components. Policies may include remote references that Neethi fetches over the network before assembling the effective policy set. The fetch logic configures a socket read timeout, which caps the wait between individual bytes but does not cap the total duration of the transfer.

An attacker who controls or influences a referenced policy URL can respond with a valid HTTP status and then emit a single byte just before each read timeout expires. Because every byte resets the timer, the connection never fails and the fetch never completes. The calling thread remains blocked in the read loop while the attacker sustains the trickle indefinitely.

In typical deployments, policy resolution runs on a request-handling or initialization thread. Repeated triggering starves the thread pool, delays legitimate SOAP requests, and can render the hosting service unresponsive. Impact is limited to availability; confidentiality and integrity are not affected.

Root Cause

The root cause is the absence of an overall transfer deadline on the HTTP client used for remote policy retrieval. Only a per-read (socket) timeout is enforced, which is insufficient against slow-drip responses. This pattern is characteristic of [CWE-400] resource-exhaustion flaws such as Slowloris-style attacks.

Attack Vector

Exploitation requires that Neethi be induced to fetch a policy from an attacker-controlled endpoint. This occurs when applications process policy documents containing remote <PolicyReference URI="..."> elements, or when a legitimate remote policy host is redirected or compromised. The attacker then serves a response body one byte at a time, pausing just under the configured read timeout between bytes. Each blocked fetch consumes one worker thread until the JVM exhausts its executor capacity.

No verified public exploit code is available. The behavior can be reproduced with any HTTP server that supports response streaming with controllable delay between writes.

Detection Methods for CVE-2026-91867

Indicators of Compromise

Outbound HTTP connections from application servers to unexpected hosts that remain open for minutes or hours while transferring only a few kilobytes.
Growing counts of threads blocked inside Neethi policy-resolution stack frames, visible in thread dumps.
SOAP or web-service request latency rising in parallel with sustained low-throughput outbound sockets.

Detection Strategies

Instrument the JVM to alert on threads that have spent excessive time in socket read operations initiated from Neethi classes.
Correlate outbound HTTP session duration with bytes transferred; flag long-lived sessions with sub-kilobyte throughput.
Inventory application dependencies to identify Neethi versions prior to 3.2.4 using software composition analysis tooling.

Monitoring Recommendations

Track thread-pool saturation metrics on services that process WS-Policy documents and alarm on sustained exhaustion.
Log every remote policy URL resolved by Neethi and review for unexpected destinations.
Monitor egress firewall logs for slow, long-duration HTTP flows from application tier hosts.

How to Mitigate CVE-2026-91867

Immediate Actions Required

Upgrade Apache Neethi to version 3.2.4 or later across all affected applications and dependency graphs.
Restrict outbound HTTP egress from services that parse WS-Policy documents to an allow-list of trusted policy hosts.
Reject or sanitize inbound policy documents that contain remote PolicyReference URIs when remote resolution is not required.

Patch Information

The Apache Neethi project addressed this issue in version 3.2.4 by bounding the total policy-fetch duration. Details are available in the Apache Mailing List Discussion and the Openwall OSS Security Update. Upgrade all direct and transitive dependencies to 3.2.4 and redeploy affected services.

Workarounds

Disable remote policy resolution in application configuration where feasible and package required policies locally.
Front outbound calls with an HTTP proxy that enforces a hard maximum response duration and minimum throughput threshold.
Reduce worker-thread waiting exposure by isolating policy-fetch calls behind a dedicated bounded executor with an aggressive timeout wrapper.

bash

# Configuration example: enforce an outbound HTTP timeout via a forward proxy
# (Squid example) drop upstream responses that stall or run excessively long
read_timeout 30 seconds
request_timeout 30 seconds
quick_abort_min 0 KB
quick_abort_max 0 KB