Executive brief
Apache Neethi, a library used for managing Web Services policies, is vulnerable to a flaw that can crash applications. By sending a specially crafted policy with deeply nested structures or missing identifiers, an attacker can cause the system to run out of memory. This results in a denial-of-service, making the affected service unavailable to legitimate users.
Technical details
A stack exhaustion or uncontrolled recursion vulnerability exists in Apache Neethi's policy parsing logic. When the library processes a WS-Policy that is either deeply nested or lacks mandatory Policy IDs, it enters a recursive loop that consumes excessive system memory. This is a remote, unauthenticated attack vector that allows an attacker to trigger a Denial of Service (DoS) by providing a malicious policy file to any application utilizing the Neethi library for parsing. The issue is resolved in version 3.2.3.
Affected products
- Apache Software Foundation Neethi versions prior to 3.2.3
Timeline
- 2026-07-24: advisory: NVD publication date
- 2026-07-24: patched: Version 3.2.3 released to address the issue