Executive brief
Apache Neethi, a library used for managing WS-Policy in Java applications, is vulnerable to a denial of service. If an application manually retrieves a remote policy via the API, an attacker could provide an excessively large policy file that consumes all available system resources. This could lead to application crashes or significant performance degradation, impacting service availability.
Technical details
Apache Neethi versions prior to 3.2.3 are vulnerable to a denial of service (DoS) attack classified under CWE-400 (Uncontrolled Resource Consumption). While remote policy references are not automatically retrieved during normalization, manual retrieval via the API lacks size constraints. An attacker can exploit this by providing a link to a 'huge' policy file, leading to resource exhaustion when the library attempts to process it. The vulnerability is resolved in version 3.2.3 by implementing a default maximum size limit on data read from remote policy references.
Affected products
- Apache Software Foundation Apache Neethi versions before 3.2.3
Timeline
- 2026-07-24: disclosed
- 2026-07-24: advisory