{
  "cveId": "CVE-2026-91864",
  "url": "https://patchblox.com/security/cve/CVE-2026-91864",
  "summary": "CVE-2026-91864 is fixed in 13 products on 1 platform, first by RHSA-2026:99018, released November 12, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "eap8-apache-sshd: A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into...",
  "description": "A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its size limits, exhausting the heap (denial of service).\nUsers are recommended to upgrade to version 3.2.4, which fixes this issue.",
  "published": "2026-09-21T11:26:20Z",
  "severity": "important",
  "cvss": 7.5,
  "epss": 0.00485,
  "epssPercentile": 0.42293,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "eap8-apache-sshd",
      "release": "RHEL 10",
      "fixedVersion": "2.20.0-1.redhat_00002.1.el10eap",
      "fix": "RHSA-2026:99018",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-99018",
      "released": "2026-11-12T01:57:07Z"
    },
    {
      "platform": "linux",
      "product": "eap8-bouncycastle",
      "release": "RHEL 10",
      "fixedVersion": "1.86.0-1.redhat_00001.1.el10eap",
      "fix": "RHSA-2026:99018",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-99018",
      "released": "2026-11-12T01:57:07Z"
    },
    {
      "platform": "linux",
      "product": "eap8-eap-product-conf-parent",
      "release": "RHEL 10",
      "fixedVersion": "801.9.1-1.GA_redhat_00002.1.el10eap",
      "fix": "RHSA-2026:99018",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-99018",
      "released": "2026-11-12T01:57:07Z"
    },
    {
      "platform": "linux",
      "product": "eap8-ironjacamar",
      "release": "RHEL 10",
      "fixedVersion": "3.1.1-1.Final_redhat_00001.1.el10eap",
      "fix": "RHSA-2026:99018",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-99018",
      "released": "2026-11-12T01:57:07Z"
    },
    {
      "platform": "linux",
      "product": "eap8-jackson-jaxrs-providers",
      "release": "RHEL 10",
      "fixedVersion": "2.18.11-1.redhat_00001.1.el10eap",
      "fix": "RHSA-2026:99018",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-99018",
      "released": "2026-11-12T01:57:07Z"
    },
    {
      "platform": "linux",
      "product": "eap8-jackson-modules-base",
      "release": "RHEL 10",
      "fixedVersion": "2.18.11-1.redhat_00001.1.el10eap",
      "fix": "RHSA-2026:99018",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-99018",
      "released": "2026-11-12T01:57:07Z"
    },
    {
      "platform": "linux",
      "product": "eap8-jackson-modules-java8",
      "release": "RHEL 10",
      "fixedVersion": "2.18.11-1.redhat_00001.1.el10eap",
      "fix": "RHSA-2026:99018",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-99018",
      "released": "2026-11-12T01:57:07Z"
    },
    {
      "platform": "linux",
      "product": "eap8-mod_cluster",
      "release": "RHEL 10",
      "fixedVersion": "2.1.1-1.Final_redhat_00001.1.el10eap",
      "fix": "RHSA-2026:99018",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-99018",
      "released": "2026-11-12T01:57:07Z"
    },
    {
      "platform": "linux",
      "product": "eap8-neethi",
      "release": "RHEL 10",
      "fixedVersion": "3.2.4-1.redhat_00001.1.el10eap",
      "fix": "RHSA-2026:99018",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-99018",
      "released": "2026-11-12T01:57:07Z"
    },
    {
      "platform": "linux",
      "product": "eap8-wildfly",
      "release": "RHEL 10",
      "fixedVersion": "8.1.9.1-1.GA_redhat_00006.1.el10eap",
      "fix": "RHSA-2026:99018",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-99018",
      "released": "2026-11-12T01:57:07Z"
    },
    {
      "platform": "linux",
      "product": "eap8-wildfly-http-client",
      "release": "RHEL 10",
      "fixedVersion": "2.1.5-1.Final_redhat_00001.1.el10eap",
      "fix": "RHSA-2026:99018",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-99018",
      "released": "2026-11-12T01:57:07Z"
    },
    {
      "platform": "linux",
      "product": "eap8-wildfly-javadocs",
      "release": "RHEL 10",
      "fixedVersion": "8.1.1-15.GA_redhat_00052.1.el10eap",
      "fix": "RHSA-2026:99018",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-99018",
      "released": "2026-11-12T01:57:07Z"
    },
    {
      "platform": "linux",
      "product": "eap8-ws-commons-XmlSchema",
      "release": "RHEL 10",
      "fixedVersion": "2.3.3-1.redhat_00001.1.el10eap",
      "fix": "RHSA-2026:99018",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-99018",
      "released": "2026-11-12T01:57:07Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-12T13:55:20Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}