CVE-2026-91865
Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service
7.5 High
CVE-2026-91865 is a high vulnerability (CVSS 7.5) in Apache Neethi, published September 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.60%, the 49th percentile. No source names a fixed version.
- Severity
- 7.5 HighCVSS 3.1, CVE List
- Exploit chance
- 0.60%EPSS, 49th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
0.60%Up 0.1 points since Sep 22, 2026
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.neethi:neethiRed Hat Lightwell:Maven From an advisory covering 4 CVEs | before 3.2.2.rhlw-00028, plus listed versions 2.02.0.12.0.22.0.32.0.4 Show 10 moreShow less2.0.53.0.03.0.13.0.23.0.33.1.03.1.13.2.03.2.13.2.2 | 3.2.2.rhlw-00028 |
eap8-apache-sshdRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:2.20.0-1.redhat_00002.1.el10eap | 0:2.20.0-1.redhat_00002.1.el10eap |
eap8-bouncycastleRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:1.86.0-1.redhat_00001.1.el10eap | 0:1.86.0-1.redhat_00001.1.el10eap |
eap8-bouncycastle-jmailRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:1.86.0-1.redhat_00001.1.el10eap | 0:1.86.0-1.redhat_00001.1.el10eap |
eap8-bouncycastle-pgRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:1.86.0-1.redhat_00001.1.el10eap | 0:1.86.0-1.redhat_00001.1.el10eap |
eap8-bouncycastle-pkixRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:1.86.0-1.redhat_00001.1.el10eap | 0:1.86.0-1.redhat_00001.1.el10eap |
eap8-bouncycastle-provRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:1.86.0-1.redhat_00001.1.el10eap | 0:1.86.0-1.redhat_00001.1.el10eap |
eap8-bouncycastle-utilRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:1.86.0-1.redhat_00001.1.el10eap | 0:1.86.0-1.redhat_00001.1.el10eap |
eap8-eap-product-conf-parentRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:801.9.1-1.GA_redhat_00002.1.el10eap | 0:801.9.1-1.GA_redhat_00002.1.el10eap |
eap8-eap-product-conf-wildfly-ee-feature-packRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:801.9.1-1.GA_redhat_00002.1.el10eap | 0:801.9.1-1.GA_redhat_00002.1.el10eap |
Show 107 moreShow less
| Package | Affected | Fixed |
|---|---|---|
eap8-ironjacamarRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el10eap | 0:3.1.1-1.Final_redhat_00001.1.el10eap |
eap8-ironjacamar-common-apiRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el10eap | 0:3.1.1-1.Final_redhat_00001.1.el10eap |
eap8-ironjacamar-common-implRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el10eap | 0:3.1.1-1.Final_redhat_00001.1.el10eap |
eap8-ironjacamar-common-spiRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el10eap | 0:3.1.1-1.Final_redhat_00001.1.el10eap |
eap8-ironjacamar-core-apiRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el10eap | 0:3.1.1-1.Final_redhat_00001.1.el10eap |
eap8-ironjacamar-core-implRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el10eap | 0:3.1.1-1.Final_redhat_00001.1.el10eap |
eap8-ironjacamar-deployers-commonRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el10eap | 0:3.1.1-1.Final_redhat_00001.1.el10eap |
eap8-ironjacamar-jdbcRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el10eap | 0:3.1.1-1.Final_redhat_00001.1.el10eap |
eap8-ironjacamar-validatorRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el10eap | 0:3.1.1-1.Final_redhat_00001.1.el10eap |
eap8-jackson-datatype-jdk8Red Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el10eap | 0:2.18.11-1.redhat_00001.1.el10eap |
eap8-jackson-datatype-jsr310Red Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el10eap | 0:2.18.11-1.redhat_00001.1.el10eap |
eap8-jackson-jaxrs-baseRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el10eap | 0:2.18.11-1.redhat_00001.1.el10eap |
eap8-jackson-jaxrs-json-providerRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el10eap | 0:2.18.11-1.redhat_00001.1.el10eap |
eap8-jackson-jaxrs-providersRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el10eap | 0:2.18.11-1.redhat_00001.1.el10eap |
eap8-jackson-module-jakarta-xmlbind-annotationsRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el10eap | 0:2.18.11-1.redhat_00001.1.el10eap |
eap8-jackson-modules-baseRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el10eap | 0:2.18.11-1.redhat_00001.1.el10eap |
eap8-jackson-modules-java8Red Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el10eap | 0:2.18.11-1.redhat_00001.1.el10eap |
eap8-mod_clusterRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:2.1.1-1.Final_redhat_00001.1.el10eap | 0:2.1.1-1.Final_redhat_00001.1.el10eap |
eap8-neethiRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:3.2.4-1.redhat_00001.1.el10eap | 0:3.2.4-1.redhat_00001.1.el10eap |
eap8-wildflyRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:8.1.9.1-1.GA_redhat_00006.1.el10eap | 0:8.1.9.1-1.GA_redhat_00006.1.el10eap |
eap8-wildfly-http-clientRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:2.1.5-1.Final_redhat_00001.1.el10eap | 0:2.1.5-1.Final_redhat_00001.1.el10eap |
eap8-wildfly-http-client-commonRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:2.1.5-1.Final_redhat_00001.1.el10eap | 0:2.1.5-1.Final_redhat_00001.1.el10eap |
eap8-wildfly-http-ejb-clientRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:2.1.5-1.Final_redhat_00001.1.el10eap | 0:2.1.5-1.Final_redhat_00001.1.el10eap |
eap8-wildfly-http-naming-clientRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:2.1.5-1.Final_redhat_00001.1.el10eap | 0:2.1.5-1.Final_redhat_00001.1.el10eap |
eap8-wildfly-http-transaction-clientRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:2.1.5-1.Final_redhat_00001.1.el10eap | 0:2.1.5-1.Final_redhat_00001.1.el10eap |
eap8-wildfly-java-jdk21Red Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:8.1.9.1-1.GA_redhat_00006.1.el10eap | 0:8.1.9.1-1.GA_redhat_00006.1.el10eap |
eap8-wildfly-javadocsRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:8.1.1-15.GA_redhat_00052.1.el10eap | 0:8.1.1-15.GA_redhat_00052.1.el10eap |
eap8-wildfly-modulesRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:8.1.9.1-1.GA_redhat_00006.1.el10eap | 0:8.1.9.1-1.GA_redhat_00006.1.el10eap |
eap8-ws-commons-XmlSchemaRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:2.3.3-1.redhat_00001.1.el10eap | 0:2.3.3-1.redhat_00001.1.el10eap |
eap8-apache-sshdRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:2.20.0-1.redhat_00002.1.el8eap | 0:2.20.0-1.redhat_00002.1.el8eap |
eap8-bouncycastleRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:1.86.0-1.redhat_00001.1.el8eap | 0:1.86.0-1.redhat_00001.1.el8eap |
eap8-bouncycastle-jmailRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:1.86.0-1.redhat_00001.1.el8eap | 0:1.86.0-1.redhat_00001.1.el8eap |
eap8-bouncycastle-pgRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:1.86.0-1.redhat_00001.1.el8eap | 0:1.86.0-1.redhat_00001.1.el8eap |
eap8-bouncycastle-pkixRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:1.86.0-1.redhat_00001.1.el8eap | 0:1.86.0-1.redhat_00001.1.el8eap |
eap8-bouncycastle-provRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:1.86.0-1.redhat_00001.1.el8eap | 0:1.86.0-1.redhat_00001.1.el8eap |
eap8-bouncycastle-utilRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:1.86.0-1.redhat_00001.1.el8eap | 0:1.86.0-1.redhat_00001.1.el8eap |
eap8-eap-product-conf-parentRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:801.9.1-1.GA_redhat_00002.1.el8eap | 0:801.9.1-1.GA_redhat_00002.1.el8eap |
eap8-eap-product-conf-wildfly-ee-feature-packRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:801.9.1-1.GA_redhat_00002.1.el8eap | 0:801.9.1-1.GA_redhat_00002.1.el8eap |
eap8-ironjacamarRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el8eap | 0:3.1.1-1.Final_redhat_00001.1.el8eap |
eap8-ironjacamar-common-apiRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el8eap | 0:3.1.1-1.Final_redhat_00001.1.el8eap |
eap8-ironjacamar-common-implRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el8eap | 0:3.1.1-1.Final_redhat_00001.1.el8eap |
eap8-ironjacamar-common-spiRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el8eap | 0:3.1.1-1.Final_redhat_00001.1.el8eap |
eap8-ironjacamar-core-apiRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el8eap | 0:3.1.1-1.Final_redhat_00001.1.el8eap |
eap8-ironjacamar-core-implRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el8eap | 0:3.1.1-1.Final_redhat_00001.1.el8eap |
eap8-ironjacamar-deployers-commonRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el8eap | 0:3.1.1-1.Final_redhat_00001.1.el8eap |
eap8-ironjacamar-jdbcRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el8eap | 0:3.1.1-1.Final_redhat_00001.1.el8eap |
eap8-ironjacamar-validatorRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el8eap | 0:3.1.1-1.Final_redhat_00001.1.el8eap |
eap8-jackson-datatype-jdk8Red Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el8eap | 0:2.18.11-1.redhat_00001.1.el8eap |
eap8-jackson-datatype-jsr310Red Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el8eap | 0:2.18.11-1.redhat_00001.1.el8eap |
eap8-jackson-jaxrs-baseRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el8eap | 0:2.18.11-1.redhat_00001.1.el8eap |
eap8-jackson-jaxrs-json-providerRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el8eap | 0:2.18.11-1.redhat_00001.1.el8eap |
eap8-jackson-jaxrs-providersRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el8eap | 0:2.18.11-1.redhat_00001.1.el8eap |
eap8-jackson-module-jakarta-xmlbind-annotationsRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el8eap | 0:2.18.11-1.redhat_00001.1.el8eap |
eap8-jackson-modules-baseRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el8eap | 0:2.18.11-1.redhat_00001.1.el8eap |
eap8-jackson-modules-java8Red Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el8eap | 0:2.18.11-1.redhat_00001.1.el8eap |
eap8-mod_clusterRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:2.1.1-1.Final_redhat_00001.1.el8eap | 0:2.1.1-1.Final_redhat_00001.1.el8eap |
eap8-neethiRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:3.2.4-1.redhat_00001.1.el8eap | 0:3.2.4-1.redhat_00001.1.el8eap |
eap8-wildflyRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:8.1.9.1-1.GA_redhat_00006.1.el8eap | 0:8.1.9.1-1.GA_redhat_00006.1.el8eap |
eap8-wildfly-http-clientRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:2.1.5-1.Final_redhat_00001.1.el8eap | 0:2.1.5-1.Final_redhat_00001.1.el8eap |
eap8-wildfly-http-client-commonRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:2.1.5-1.Final_redhat_00001.1.el8eap | 0:2.1.5-1.Final_redhat_00001.1.el8eap |
eap8-wildfly-http-ejb-clientRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:2.1.5-1.Final_redhat_00001.1.el8eap | 0:2.1.5-1.Final_redhat_00001.1.el8eap |
eap8-wildfly-http-naming-clientRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:2.1.5-1.Final_redhat_00001.1.el8eap | 0:2.1.5-1.Final_redhat_00001.1.el8eap |
eap8-wildfly-http-transaction-clientRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:2.1.5-1.Final_redhat_00001.1.el8eap | 0:2.1.5-1.Final_redhat_00001.1.el8eap |
eap8-wildfly-java-jdk17Red Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:8.1.9.1-1.GA_redhat_00006.1.el8eap | 0:8.1.9.1-1.GA_redhat_00006.1.el8eap |
eap8-wildfly-java-jdk21Red Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:8.1.9.1-1.GA_redhat_00006.1.el8eap | 0:8.1.9.1-1.GA_redhat_00006.1.el8eap |
eap8-wildfly-javadocsRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:8.1.1-15.GA_redhat_00052.1.el8eap | 0:8.1.1-15.GA_redhat_00052.1.el8eap |
eap8-wildfly-modulesRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:8.1.9.1-1.GA_redhat_00006.1.el8eap | 0:8.1.9.1-1.GA_redhat_00006.1.el8eap |
eap8-ws-commons-XmlSchemaRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:2.3.3-1.redhat_00001.1.el8eap | 0:2.3.3-1.redhat_00001.1.el8eap |
eap8-apache-sshdRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:2.20.0-1.redhat_00002.1.el9eap | 0:2.20.0-1.redhat_00002.1.el9eap |
eap8-bouncycastleRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:1.86.0-1.redhat_00001.1.el9eap | 0:1.86.0-1.redhat_00001.1.el9eap |
eap8-bouncycastle-jmailRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:1.86.0-1.redhat_00001.1.el9eap | 0:1.86.0-1.redhat_00001.1.el9eap |
eap8-bouncycastle-pgRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:1.86.0-1.redhat_00001.1.el9eap | 0:1.86.0-1.redhat_00001.1.el9eap |
eap8-bouncycastle-pkixRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:1.86.0-1.redhat_00001.1.el9eap | 0:1.86.0-1.redhat_00001.1.el9eap |
eap8-bouncycastle-provRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:1.86.0-1.redhat_00001.1.el9eap | 0:1.86.0-1.redhat_00001.1.el9eap |
eap8-bouncycastle-utilRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:1.86.0-1.redhat_00001.1.el9eap | 0:1.86.0-1.redhat_00001.1.el9eap |
eap8-eap-product-conf-parentRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:801.9.1-1.GA_redhat_00002.1.el9eap | 0:801.9.1-1.GA_redhat_00002.1.el9eap |
eap8-eap-product-conf-wildfly-ee-feature-packRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:801.9.1-1.GA_redhat_00002.1.el9eap | 0:801.9.1-1.GA_redhat_00002.1.el9eap |
eap8-ironjacamarRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el9eap | 0:3.1.1-1.Final_redhat_00001.1.el9eap |
eap8-ironjacamar-common-apiRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el9eap | 0:3.1.1-1.Final_redhat_00001.1.el9eap |
eap8-ironjacamar-common-implRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el9eap | 0:3.1.1-1.Final_redhat_00001.1.el9eap |
eap8-ironjacamar-common-spiRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el9eap | 0:3.1.1-1.Final_redhat_00001.1.el9eap |
eap8-ironjacamar-core-apiRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el9eap | 0:3.1.1-1.Final_redhat_00001.1.el9eap |
eap8-ironjacamar-core-implRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el9eap | 0:3.1.1-1.Final_redhat_00001.1.el9eap |
eap8-ironjacamar-deployers-commonRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el9eap | 0:3.1.1-1.Final_redhat_00001.1.el9eap |
eap8-ironjacamar-jdbcRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el9eap | 0:3.1.1-1.Final_redhat_00001.1.el9eap |
eap8-ironjacamar-validatorRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el9eap | 0:3.1.1-1.Final_redhat_00001.1.el9eap |
eap8-jackson-datatype-jdk8Red Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el9eap | 0:2.18.11-1.redhat_00001.1.el9eap |
eap8-jackson-datatype-jsr310Red Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el9eap | 0:2.18.11-1.redhat_00001.1.el9eap |
eap8-jackson-jaxrs-baseRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el9eap | 0:2.18.11-1.redhat_00001.1.el9eap |
eap8-jackson-jaxrs-json-providerRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el9eap | 0:2.18.11-1.redhat_00001.1.el9eap |
eap8-jackson-jaxrs-providersRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el9eap | 0:2.18.11-1.redhat_00001.1.el9eap |
eap8-jackson-module-jakarta-xmlbind-annotationsRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el9eap | 0:2.18.11-1.redhat_00001.1.el9eap |
eap8-jackson-modules-baseRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el9eap | 0:2.18.11-1.redhat_00001.1.el9eap |
eap8-jackson-modules-java8Red Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el9eap | 0:2.18.11-1.redhat_00001.1.el9eap |
eap8-mod_clusterRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:2.1.1-1.Final_redhat_00001.1.el9eap | 0:2.1.1-1.Final_redhat_00001.1.el9eap |
eap8-neethiRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:3.2.4-1.redhat_00001.1.el9eap | 0:3.2.4-1.redhat_00001.1.el9eap |
eap8-wildflyRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:8.1.9.1-1.GA_redhat_00006.1.el9eap | 0:8.1.9.1-1.GA_redhat_00006.1.el9eap |
eap8-wildfly-http-clientRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:2.1.5-1.Final_redhat_00001.1.el9eap | 0:2.1.5-1.Final_redhat_00001.1.el9eap |
eap8-wildfly-http-client-commonRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:2.1.5-1.Final_redhat_00001.1.el9eap | 0:2.1.5-1.Final_redhat_00001.1.el9eap |
eap8-wildfly-http-ejb-clientRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:2.1.5-1.Final_redhat_00001.1.el9eap | 0:2.1.5-1.Final_redhat_00001.1.el9eap |
eap8-wildfly-http-naming-clientRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:2.1.5-1.Final_redhat_00001.1.el9eap | 0:2.1.5-1.Final_redhat_00001.1.el9eap |
eap8-wildfly-http-transaction-clientRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:2.1.5-1.Final_redhat_00001.1.el9eap | 0:2.1.5-1.Final_redhat_00001.1.el9eap |
eap8-wildfly-java-jdk17Red Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:8.1.9.1-1.GA_redhat_00006.1.el9eap | 0:8.1.9.1-1.GA_redhat_00006.1.el9eap |
eap8-wildfly-java-jdk21Red Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:8.1.9.1-1.GA_redhat_00006.1.el9eap | 0:8.1.9.1-1.GA_redhat_00006.1.el9eap |
eap8-wildfly-javadocsRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:8.1.1-15.GA_redhat_00052.1.el9eap | 0:8.1.1-15.GA_redhat_00052.1.el9eap |
eap8-wildfly-modulesRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:8.1.9.1-1.GA_redhat_00006.1.el9eap | 0:8.1.9.1-1.GA_redhat_00006.1.el9eap |
eap8-ws-commons-XmlSchemaRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:2.3.3-1.redhat_00001.1.el9eap | 0:2.3.3-1.redhat_00001.1.el9eap |
What each source reports
CVE List Score used
Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service
A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.
- Record
CVE-2026-91865- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2026-83887
A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.
- Record
EUVD-2026-83887- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-6vm6-6w33-f874
A small WS-Policy document using repeated policy references can force Neethi to re-expand the...
A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.
- Record
GHSA-6vm6-6w33-f874- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
NVD
A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.
- Record
CVE-2026-91865- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSV
Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service
A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.
- Record
CVE-2026-91865- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHLW-2026-5e3f8ccb11a37ba5
Lightwell Security Advisory: neethi 3.2.2.rhlw-00028
Red Hat Lightwell has released org.apache.neethi:neethi 3.2.2.rhlw-00028 with backported fixes for CVE-2026-91863, CVE-2026-91865, CVE-2026-91866, and CVE-2026-91867.
CVE-2026-91863: Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service
CVE-2026-91865: Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service
CVE-2026-91866: Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of service
CVE-2026-91867: Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitely
This patched artifact is a drop-in replacement for org.apache.neethi:neethi 3.2.2 from Maven Central.
- Record
RHLW-2026-5e3f8ccb11a37ba5- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:99018
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.9 security update
- Record
RHSA-2026:99018- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-13
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
lists.apache.org/thread/l48btqh02rlpsgf5p6r5ltqk1cb69dtc
openwall.com/lists/oss-security/2026/09/18/12
nvd.nist.gov/vuln/detail/CVE-2026-91865
github.com/advisories/GHSA-6vm6-6w33-f874
repo.maven.apache.org/maven2
Show 143 moreShow less
access.redhat.com/errata/RHSA-2026:99018
bugzilla.redhat.com/show_bug.cgi?id=2491669
issues.redhat.com/browse/JBEAP-35049
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_99018.json
cve.org/CVERecord?id=CVE-2026-12802