CVE-2026-91867
Description
A flaw was found in Apache Neethi. When fetching a remote policy reference, Apache Neethi only limits the time per read operation, not the total transfer time. This vulnerability allows a remote, malicious server to slowly send data, keeping the connection open indefinitely. This can tie up the calling thread, leading to a denial of service (DoS) for the application.
Statement
This vulnerability is rated as having a Moderate impact because exploitation requires the client application to fetch external policy documents from an untrusted or compromised remote endpoint, limiting exposure to services configured to process unvetted remote references. When an untrusted server slowly transmits response data to avoid individual read timeouts, it can monopolize worker threads and lead to resource starvation or service unresponsiveness. However, the flaw cannot be leveraged for arbitrary code execution or unauthorized data disclosure.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
