CVE-2026-91863: Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service

<p>Posted by Colm O hEigeartaigh on Sep 18</p>Severity: moderate <br /> <br /> Affected versions:<br /> <br /> - Apache Neethi (org.apache.neethi:neethi) before 3.2.4<br /> <br /> Description:<br /> <br /> A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi&apos;s nesting-depth limit and <br /> exhaust the thread stack, crashing the parser (denial of service