Technical impact
Apache Neethi software is vulnerable to a denial‑of‑service condition caused by algorithmic complexity in policy normalization. The implementation expands policy alternatives using a Cartesian cross‑product without a defined limit, leading to unbounded memory allocation that can exhaust the JVM heap. As a result, an attacker can trigger a service crash or severe performance degradation through specially crafted WS‑Policy documents. The weakness is identified as CWE‑400 and CWE‑770, which highlight unbounded resource consumption.
Affected Systems
All installations of Apache Neethi up to the 3.2.1 release are affected. The vendor recommends upgrading to version 3.2.2 or later, where a maximum limit on normalized policy alternatives is enforced. There are no other specific vendor or product exceptions listed.
Risk and Exploitability
The CVSS score of 7.5 indicates a high severity denial‑of‑service vulnerability. The EPSS score is < 1%, indicating a very low but nonzero likelihood of exploitation. The lack of a KEV listing suggests that no widespread attacks are currently reported. The most probable attack vector involves an attacker submitting a malicious WS‑Policy document to a service that uses Neethi for policy handling. If successful, the attacker can cause the process to consume all heap memory, leading to a crash or significant slowdown.
Github GHSA