CVE-2026-91864
Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustion
7.5 High
CVE-2026-91864 is a high vulnerability (CVSS 7.5) in Apache Neethi, published September 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 42nd percentile. No source names a fixed version.
- Severity
- 7.5 HighCVSS 3.1, CVE List
- Exploit chance
- 0.48%EPSS, 42nd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its size limits, exhausting the heap (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
0.48%Unchanged since Sep 22, 2026
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
eap8-apache-sshdRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:2.20.0-1.redhat_00002.1.el10eap | 0:2.20.0-1.redhat_00002.1.el10eap |
eap8-bouncycastleRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:1.86.0-1.redhat_00001.1.el10eap | 0:1.86.0-1.redhat_00001.1.el10eap |
eap8-bouncycastle-jmailRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:1.86.0-1.redhat_00001.1.el10eap | 0:1.86.0-1.redhat_00001.1.el10eap |
eap8-bouncycastle-pgRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:1.86.0-1.redhat_00001.1.el10eap | 0:1.86.0-1.redhat_00001.1.el10eap |
eap8-bouncycastle-pkixRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:1.86.0-1.redhat_00001.1.el10eap | 0:1.86.0-1.redhat_00001.1.el10eap |
eap8-bouncycastle-provRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:1.86.0-1.redhat_00001.1.el10eap | 0:1.86.0-1.redhat_00001.1.el10eap |
eap8-bouncycastle-utilRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:1.86.0-1.redhat_00001.1.el10eap | 0:1.86.0-1.redhat_00001.1.el10eap |
eap8-eap-product-conf-parentRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:801.9.1-1.GA_redhat_00002.1.el10eap | 0:801.9.1-1.GA_redhat_00002.1.el10eap |
eap8-eap-product-conf-wildfly-ee-feature-packRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:801.9.1-1.GA_redhat_00002.1.el10eap | 0:801.9.1-1.GA_redhat_00002.1.el10eap |
eap8-ironjacamarRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el10eap | 0:3.1.1-1.Final_redhat_00001.1.el10eap |
Show 106 moreShow less
| Package | Affected | Fixed |
|---|---|---|
eap8-ironjacamar-common-apiRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el10eap | 0:3.1.1-1.Final_redhat_00001.1.el10eap |
eap8-ironjacamar-common-implRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el10eap | 0:3.1.1-1.Final_redhat_00001.1.el10eap |
eap8-ironjacamar-common-spiRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el10eap | 0:3.1.1-1.Final_redhat_00001.1.el10eap |
eap8-ironjacamar-core-apiRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el10eap | 0:3.1.1-1.Final_redhat_00001.1.el10eap |
eap8-ironjacamar-core-implRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el10eap | 0:3.1.1-1.Final_redhat_00001.1.el10eap |
eap8-ironjacamar-deployers-commonRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el10eap | 0:3.1.1-1.Final_redhat_00001.1.el10eap |
eap8-ironjacamar-jdbcRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el10eap | 0:3.1.1-1.Final_redhat_00001.1.el10eap |
eap8-ironjacamar-validatorRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el10eap | 0:3.1.1-1.Final_redhat_00001.1.el10eap |
eap8-jackson-datatype-jdk8Red Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el10eap | 0:2.18.11-1.redhat_00001.1.el10eap |
eap8-jackson-datatype-jsr310Red Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el10eap | 0:2.18.11-1.redhat_00001.1.el10eap |
eap8-jackson-jaxrs-baseRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el10eap | 0:2.18.11-1.redhat_00001.1.el10eap |
eap8-jackson-jaxrs-json-providerRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el10eap | 0:2.18.11-1.redhat_00001.1.el10eap |
eap8-jackson-jaxrs-providersRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el10eap | 0:2.18.11-1.redhat_00001.1.el10eap |
eap8-jackson-module-jakarta-xmlbind-annotationsRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el10eap | 0:2.18.11-1.redhat_00001.1.el10eap |
eap8-jackson-modules-baseRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el10eap | 0:2.18.11-1.redhat_00001.1.el10eap |
eap8-jackson-modules-java8Red Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el10eap | 0:2.18.11-1.redhat_00001.1.el10eap |
eap8-mod_clusterRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:2.1.1-1.Final_redhat_00001.1.el10eap | 0:2.1.1-1.Final_redhat_00001.1.el10eap |
eap8-neethiRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:3.2.4-1.redhat_00001.1.el10eap | 0:3.2.4-1.redhat_00001.1.el10eap |
eap8-wildflyRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:8.1.9.1-1.GA_redhat_00006.1.el10eap | 0:8.1.9.1-1.GA_redhat_00006.1.el10eap |
eap8-wildfly-http-clientRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:2.1.5-1.Final_redhat_00001.1.el10eap | 0:2.1.5-1.Final_redhat_00001.1.el10eap |
eap8-wildfly-http-client-commonRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:2.1.5-1.Final_redhat_00001.1.el10eap | 0:2.1.5-1.Final_redhat_00001.1.el10eap |
eap8-wildfly-http-ejb-clientRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:2.1.5-1.Final_redhat_00001.1.el10eap | 0:2.1.5-1.Final_redhat_00001.1.el10eap |
eap8-wildfly-http-naming-clientRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:2.1.5-1.Final_redhat_00001.1.el10eap | 0:2.1.5-1.Final_redhat_00001.1.el10eap |
eap8-wildfly-http-transaction-clientRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:2.1.5-1.Final_redhat_00001.1.el10eap | 0:2.1.5-1.Final_redhat_00001.1.el10eap |
eap8-wildfly-java-jdk21Red Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:8.1.9.1-1.GA_redhat_00006.1.el10eap | 0:8.1.9.1-1.GA_redhat_00006.1.el10eap |
eap8-wildfly-javadocsRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:8.1.1-15.GA_redhat_00052.1.el10eap | 0:8.1.1-15.GA_redhat_00052.1.el10eap |
eap8-wildfly-modulesRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:8.1.9.1-1.GA_redhat_00006.1.el10eap | 0:8.1.9.1-1.GA_redhat_00006.1.el10eap |
eap8-ws-commons-XmlSchemaRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 21 CVEs | before 0:2.3.3-1.redhat_00001.1.el10eap | 0:2.3.3-1.redhat_00001.1.el10eap |
eap8-apache-sshdRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:2.20.0-1.redhat_00002.1.el8eap | 0:2.20.0-1.redhat_00002.1.el8eap |
eap8-bouncycastleRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:1.86.0-1.redhat_00001.1.el8eap | 0:1.86.0-1.redhat_00001.1.el8eap |
eap8-bouncycastle-jmailRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:1.86.0-1.redhat_00001.1.el8eap | 0:1.86.0-1.redhat_00001.1.el8eap |
eap8-bouncycastle-pgRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:1.86.0-1.redhat_00001.1.el8eap | 0:1.86.0-1.redhat_00001.1.el8eap |
eap8-bouncycastle-pkixRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:1.86.0-1.redhat_00001.1.el8eap | 0:1.86.0-1.redhat_00001.1.el8eap |
eap8-bouncycastle-provRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:1.86.0-1.redhat_00001.1.el8eap | 0:1.86.0-1.redhat_00001.1.el8eap |
eap8-bouncycastle-utilRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:1.86.0-1.redhat_00001.1.el8eap | 0:1.86.0-1.redhat_00001.1.el8eap |
eap8-eap-product-conf-parentRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:801.9.1-1.GA_redhat_00002.1.el8eap | 0:801.9.1-1.GA_redhat_00002.1.el8eap |
eap8-eap-product-conf-wildfly-ee-feature-packRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:801.9.1-1.GA_redhat_00002.1.el8eap | 0:801.9.1-1.GA_redhat_00002.1.el8eap |
eap8-ironjacamarRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el8eap | 0:3.1.1-1.Final_redhat_00001.1.el8eap |
eap8-ironjacamar-common-apiRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el8eap | 0:3.1.1-1.Final_redhat_00001.1.el8eap |
eap8-ironjacamar-common-implRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el8eap | 0:3.1.1-1.Final_redhat_00001.1.el8eap |
eap8-ironjacamar-common-spiRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el8eap | 0:3.1.1-1.Final_redhat_00001.1.el8eap |
eap8-ironjacamar-core-apiRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el8eap | 0:3.1.1-1.Final_redhat_00001.1.el8eap |
eap8-ironjacamar-core-implRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el8eap | 0:3.1.1-1.Final_redhat_00001.1.el8eap |
eap8-ironjacamar-deployers-commonRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el8eap | 0:3.1.1-1.Final_redhat_00001.1.el8eap |
eap8-ironjacamar-jdbcRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el8eap | 0:3.1.1-1.Final_redhat_00001.1.el8eap |
eap8-ironjacamar-validatorRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el8eap | 0:3.1.1-1.Final_redhat_00001.1.el8eap |
eap8-jackson-datatype-jdk8Red Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el8eap | 0:2.18.11-1.redhat_00001.1.el8eap |
eap8-jackson-datatype-jsr310Red Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el8eap | 0:2.18.11-1.redhat_00001.1.el8eap |
eap8-jackson-jaxrs-baseRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el8eap | 0:2.18.11-1.redhat_00001.1.el8eap |
eap8-jackson-jaxrs-json-providerRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el8eap | 0:2.18.11-1.redhat_00001.1.el8eap |
eap8-jackson-jaxrs-providersRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el8eap | 0:2.18.11-1.redhat_00001.1.el8eap |
eap8-jackson-module-jakarta-xmlbind-annotationsRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el8eap | 0:2.18.11-1.redhat_00001.1.el8eap |
eap8-jackson-modules-baseRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el8eap | 0:2.18.11-1.redhat_00001.1.el8eap |
eap8-jackson-modules-java8Red Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el8eap | 0:2.18.11-1.redhat_00001.1.el8eap |
eap8-mod_clusterRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:2.1.1-1.Final_redhat_00001.1.el8eap | 0:2.1.1-1.Final_redhat_00001.1.el8eap |
eap8-neethiRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:3.2.4-1.redhat_00001.1.el8eap | 0:3.2.4-1.redhat_00001.1.el8eap |
eap8-wildflyRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:8.1.9.1-1.GA_redhat_00006.1.el8eap | 0:8.1.9.1-1.GA_redhat_00006.1.el8eap |
eap8-wildfly-http-clientRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:2.1.5-1.Final_redhat_00001.1.el8eap | 0:2.1.5-1.Final_redhat_00001.1.el8eap |
eap8-wildfly-http-client-commonRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:2.1.5-1.Final_redhat_00001.1.el8eap | 0:2.1.5-1.Final_redhat_00001.1.el8eap |
eap8-wildfly-http-ejb-clientRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:2.1.5-1.Final_redhat_00001.1.el8eap | 0:2.1.5-1.Final_redhat_00001.1.el8eap |
eap8-wildfly-http-naming-clientRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:2.1.5-1.Final_redhat_00001.1.el8eap | 0:2.1.5-1.Final_redhat_00001.1.el8eap |
eap8-wildfly-http-transaction-clientRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:2.1.5-1.Final_redhat_00001.1.el8eap | 0:2.1.5-1.Final_redhat_00001.1.el8eap |
eap8-wildfly-java-jdk17Red Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:8.1.9.1-1.GA_redhat_00006.1.el8eap | 0:8.1.9.1-1.GA_redhat_00006.1.el8eap |
eap8-wildfly-java-jdk21Red Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:8.1.9.1-1.GA_redhat_00006.1.el8eap | 0:8.1.9.1-1.GA_redhat_00006.1.el8eap |
eap8-wildfly-javadocsRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:8.1.1-15.GA_redhat_00052.1.el8eap | 0:8.1.1-15.GA_redhat_00052.1.el8eap |
eap8-wildfly-modulesRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:8.1.9.1-1.GA_redhat_00006.1.el8eap | 0:8.1.9.1-1.GA_redhat_00006.1.el8eap |
eap8-ws-commons-XmlSchemaRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 21 CVEs | before 0:2.3.3-1.redhat_00001.1.el8eap | 0:2.3.3-1.redhat_00001.1.el8eap |
eap8-apache-sshdRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:2.20.0-1.redhat_00002.1.el9eap | 0:2.20.0-1.redhat_00002.1.el9eap |
eap8-bouncycastleRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:1.86.0-1.redhat_00001.1.el9eap | 0:1.86.0-1.redhat_00001.1.el9eap |
eap8-bouncycastle-jmailRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:1.86.0-1.redhat_00001.1.el9eap | 0:1.86.0-1.redhat_00001.1.el9eap |
eap8-bouncycastle-pgRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:1.86.0-1.redhat_00001.1.el9eap | 0:1.86.0-1.redhat_00001.1.el9eap |
eap8-bouncycastle-pkixRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:1.86.0-1.redhat_00001.1.el9eap | 0:1.86.0-1.redhat_00001.1.el9eap |
eap8-bouncycastle-provRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:1.86.0-1.redhat_00001.1.el9eap | 0:1.86.0-1.redhat_00001.1.el9eap |
eap8-bouncycastle-utilRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:1.86.0-1.redhat_00001.1.el9eap | 0:1.86.0-1.redhat_00001.1.el9eap |
eap8-eap-product-conf-parentRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:801.9.1-1.GA_redhat_00002.1.el9eap | 0:801.9.1-1.GA_redhat_00002.1.el9eap |
eap8-eap-product-conf-wildfly-ee-feature-packRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:801.9.1-1.GA_redhat_00002.1.el9eap | 0:801.9.1-1.GA_redhat_00002.1.el9eap |
eap8-ironjacamarRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el9eap | 0:3.1.1-1.Final_redhat_00001.1.el9eap |
eap8-ironjacamar-common-apiRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el9eap | 0:3.1.1-1.Final_redhat_00001.1.el9eap |
eap8-ironjacamar-common-implRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el9eap | 0:3.1.1-1.Final_redhat_00001.1.el9eap |
eap8-ironjacamar-common-spiRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el9eap | 0:3.1.1-1.Final_redhat_00001.1.el9eap |
eap8-ironjacamar-core-apiRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el9eap | 0:3.1.1-1.Final_redhat_00001.1.el9eap |
eap8-ironjacamar-core-implRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el9eap | 0:3.1.1-1.Final_redhat_00001.1.el9eap |
eap8-ironjacamar-deployers-commonRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el9eap | 0:3.1.1-1.Final_redhat_00001.1.el9eap |
eap8-ironjacamar-jdbcRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el9eap | 0:3.1.1-1.Final_redhat_00001.1.el9eap |
eap8-ironjacamar-validatorRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:3.1.1-1.Final_redhat_00001.1.el9eap | 0:3.1.1-1.Final_redhat_00001.1.el9eap |
eap8-jackson-datatype-jdk8Red Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el9eap | 0:2.18.11-1.redhat_00001.1.el9eap |
eap8-jackson-datatype-jsr310Red Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el9eap | 0:2.18.11-1.redhat_00001.1.el9eap |
eap8-jackson-jaxrs-baseRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el9eap | 0:2.18.11-1.redhat_00001.1.el9eap |
eap8-jackson-jaxrs-json-providerRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el9eap | 0:2.18.11-1.redhat_00001.1.el9eap |
eap8-jackson-jaxrs-providersRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el9eap | 0:2.18.11-1.redhat_00001.1.el9eap |
eap8-jackson-module-jakarta-xmlbind-annotationsRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el9eap | 0:2.18.11-1.redhat_00001.1.el9eap |
eap8-jackson-modules-baseRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el9eap | 0:2.18.11-1.redhat_00001.1.el9eap |
eap8-jackson-modules-java8Red Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:2.18.11-1.redhat_00001.1.el9eap | 0:2.18.11-1.redhat_00001.1.el9eap |
eap8-mod_clusterRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:2.1.1-1.Final_redhat_00001.1.el9eap | 0:2.1.1-1.Final_redhat_00001.1.el9eap |
eap8-neethiRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:3.2.4-1.redhat_00001.1.el9eap | 0:3.2.4-1.redhat_00001.1.el9eap |
eap8-wildflyRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:8.1.9.1-1.GA_redhat_00006.1.el9eap | 0:8.1.9.1-1.GA_redhat_00006.1.el9eap |
eap8-wildfly-http-clientRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:2.1.5-1.Final_redhat_00001.1.el9eap | 0:2.1.5-1.Final_redhat_00001.1.el9eap |
eap8-wildfly-http-client-commonRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:2.1.5-1.Final_redhat_00001.1.el9eap | 0:2.1.5-1.Final_redhat_00001.1.el9eap |
eap8-wildfly-http-ejb-clientRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:2.1.5-1.Final_redhat_00001.1.el9eap | 0:2.1.5-1.Final_redhat_00001.1.el9eap |
eap8-wildfly-http-naming-clientRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:2.1.5-1.Final_redhat_00001.1.el9eap | 0:2.1.5-1.Final_redhat_00001.1.el9eap |
eap8-wildfly-http-transaction-clientRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:2.1.5-1.Final_redhat_00001.1.el9eap | 0:2.1.5-1.Final_redhat_00001.1.el9eap |
eap8-wildfly-java-jdk17Red Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:8.1.9.1-1.GA_redhat_00006.1.el9eap | 0:8.1.9.1-1.GA_redhat_00006.1.el9eap |
eap8-wildfly-java-jdk21Red Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:8.1.9.1-1.GA_redhat_00006.1.el9eap | 0:8.1.9.1-1.GA_redhat_00006.1.el9eap |
eap8-wildfly-javadocsRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:8.1.1-15.GA_redhat_00052.1.el9eap | 0:8.1.1-15.GA_redhat_00052.1.el9eap |
eap8-wildfly-modulesRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:8.1.9.1-1.GA_redhat_00006.1.el9eap | 0:8.1.9.1-1.GA_redhat_00006.1.el9eap |
eap8-ws-commons-XmlSchemaRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 21 CVEs | before 0:2.3.3-1.redhat_00001.1.el9eap | 0:2.3.3-1.redhat_00001.1.el9eap |
What each source reports
CVE List Score used
Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustion
A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its size limits, exhausting the heap (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.
- Record
CVE-2026-91864- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2026-83886
A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its size limits, exhausting the heap (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.
- Record
EUVD-2026-83886- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-cw6x-vx7r-8x4q
A specially crafted WS-Policy document can pack unlimited content inside a policy assertion,...
A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its size limits, exhausting the heap (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.
- Record
GHSA-cw6x-vx7r-8x4q- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
NVD
A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its size limits, exhausting the heap (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.
- Record
CVE-2026-91864- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSV
Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustion
A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its size limits, exhausting the heap (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.
- Record
CVE-2026-91864- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:99018
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.9 security update
- Record
RHSA-2026:99018- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-13
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, facts, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
lists.apache.org/thread/400kbynbyhqhsjkv1yz251jm9wdz8z69
openwall.com/lists/oss-security/2026/09/18/11
nvd.nist.gov/vuln/detail/CVE-2026-91864
github.com/advisories/GHSA-cw6x-vx7r-8x4q
repo.maven.apache.org/maven2
Show 138 moreShow less
access.redhat.com/errata/RHSA-2026:99018
bugzilla.redhat.com/show_bug.cgi?id=2491669
issues.redhat.com/browse/JBEAP-35049
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_99018.json
cve.org/CVERecord?id=CVE-2026-12802