PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-91866 Apache CVE debrief

A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU for a long time (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue. This denial of service vulnerability can be triggered by a malicious pair of WS-Policy documents, potentially leading to significant performance degradation. Affected users should assess their exposure and take necessary actions to prevent exploitation.

Vendor
Apache
Product
Neethi
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-21
Original CVE updated
2026-09-25
Advisory published
2026-09-21
Advisory updated
2026-09-25

Who should care

Users of Apache Neethi should assess their exposure and upgrade to version 3.2.4 to prevent denial of service. Additionally, users should review their current configurations and ensure that they are not vulnerable to this issue. It is also recommended to monitor for suspicious activity and apply vendor advisory guidance. Affected operators, platforms, and security teams should prioritize this vulnerability and take a

Why it matters

CVE-2026-91866 is a denial of service vulnerability in Apache Neethi that can be exploited by a specially crafted pair of WS-Policy documents. Users should upgrade to version 3.2.4 to prevent this issue.

  • Denial of service due to CPU pinning
  • Potential for significant performance degradation

Technical summary

A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU for a long time (denial of service). The vulnerability is due to the inefficient handling of WS-Policy documents, which can lead to CPU exhaustion. Users are advised to upgrade to version 3.2.4 to prevent this issue. The vulnerability has a high CVSS score of 7.5, indicating a significant threat to affected systems.

Defensive priority

Upgrade to version 3.2.4 to prevent denial of service

Recommended defensive actions

  • Upgrade to version 3.2.4
  • Review and apply vendor advisory
  • Monitor for suspicious activity

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, and a vendor advisory is available on the Apache mailing list.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-91866 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-91866

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-91866 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-91866

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.