Executive brief
Apache Neethi, a Web Services policy processing library, fails to enforce size limits on policy assertion content. An attacker can craft a malicious WS-Policy document that causes the library to allocate unlimited heap memory without restriction, leading to denial of service by exhausting available memory and crashing the application.
Technical details
Neethi improperly handles WS-Policy documents by copying unlimited content from policy assertions into memory without applying size limit checks. An attacker sends a specially crafted WS-Policy XML document over the network, triggering uncontrolled heap allocation during parsing. No authentication or user interaction is required; the vulnerability is triggered simply by processing a malicious document.
Affected products
- Apache Neethi before 3.2.4
Timeline
- 2026-09-21: disclosed