CVE-2026-91866: Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of service

<p>Posted by Colm O hEigeartaigh on Sep 18</p>Severity: moderate <br /> <br /> Affected versions:<br /> <br /> - Apache Neethi (org.apache.neethi:neethi) before 3.2.4<br /> <br /> Description:<br /> <br /> A specially crafted pair of WS-Policy documents can force Neethi&apos;s policy-intersection to do exponential amounts of <br /> work, pinning the CPU for a long time (denial of service).<br /> U