What is GHSA-6vm6-6w33-f874?

GHSA-6vm6-6w33-f874 is a security advisory published by GitHub Security Advisories with High severity. A small WS-Policy document using repeated policy references can force Neethi to re-expand the...

Which CVE IDs does GHSA-6vm6-6w33-f874 cover?

GHSA-6vm6-6w33-f874 covers the following CVE IDs: CVE-2026-91865. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6vm6-6w33-f874?

GHSA-6vm6-6w33-f874 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-6vm6-6w33-f874HighCVSS 7.5

A small WS-Policy document using repeated policy references can force Neethi to re-expand the...

Vendor

GitHub Security Advisories

Published

September 21, 2026

Last Modified

September 21, 2026

🔗 CVE IDs covered (1)

CVE-2026-91865 →

📋 Description

A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-91865
https://lists.apache.org/thread/l48btqh02rlpsgf5p6r5ltqk1cb69dtc
http://www.openwall.com/lists/oss-security/2026/09/18/12
https://github.com/advisories/GHSA-6vm6-6w33-f874