Is CVE-2026-91864 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-91864 being exploited in the wild.

How severe is CVE-2026-91864?

High severity, with a CVSS score of 7.5, published 21 September 2026.

Is there a fix for CVE-2026-91864?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Am I affected by CVE-2026-91864?

Check whether you run Apache Neethi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-91864: Apache Neethi heap exhaustion in WS-Policy processing

CVE-2026-91864 · Severity: high · CVSS 7.5 · Published 2026-09-21

Apache Neethi, a Web Services policy processing library, fails to enforce size limits on policy assertion content. An attacker can craft a malicious WS-Policy document that causes the library to allocate unlimited heap memory without restriction, leading to denial of service by exhausting available memory and crashing the application.

Technologies: Apache Neethi. Vendors: Apache.

Quick answers

Is CVE-2026-91864 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-91864 being exploited in the wild.
How severe is CVE-2026-91864?: High severity, with a CVSS score of 7.5, published 21 September 2026.
Which products and versions are affected?: Apache Neethi before 3.2.4.
Is there a fix for CVE-2026-91864?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-91864 attacked?: It is in a software library.
Am I affected by CVE-2026-91864?: Check whether you run Apache Neethi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Neethi improperly handles WS-Policy documents by copying unlimited content from policy assertions into memory without applying size limit checks. An attacker sends a specially crafted WS-Policy XML document over the network, triggering uncontrolled heap allocation during parsing. No authentication or user interaction is required; the vulnerability is triggered simply by processing a malicious document.

Affected products

Apache Neethi before 3.2.4

Timeline

2026-09-21: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.