CVE-2026-91865: Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service

<p>Posted by Colm O hEigeartaigh on Sep 18</p>Severity: moderate <br /> <br /> Affected versions:<br /> <br /> - Apache Neethi (org.apache.neethi:neethi) before 3.2.4<br /> <br /> Description:<br /> <br /> A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references <br /> exponentially during normalization, consuming huge amounts of CPU and memory