CVE-2026-91864: Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustion

<p>Posted by Colm O hEigeartaigh on Sep 18</p>Severity: moderate <br /> <br /> Affected versions:<br /> <br /> - Apache Neethi (org.apache.neethi:neethi) before 3.2.4<br /> <br /> Description:<br /> <br /> A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into <br /> memory without counting it against its size limits, exhausting the he