Apache Neethi fails to detect circular references in WS-Policy documents, allowing an attacker to craft a policy that triggers an infinite loop or stack overflow during policy normalisation. This flaw is a classic example of CWE-400: Uncontrolled Resource Consumption, and its primary impact is a denial of service where the application may crash, hang, or become unresponsive after processing the malicious policy.

The Apache Software Foundation’s Apache Neethi library is affected; any version older than 3.2.2 is vulnerable. The recommended fix is to upgrade to the 3.2.2 release, which contains the patch for this issue.

The CVSS score of 7.5 indicates high severity, but the EPSS score is not available, so the exact likelihood of exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw by supplying a crafted WS‑Policy document that contains circular references to a Neethi‑based application, triggering a denial of service on systems that accept or load remote policy documents, or on local applications that do not validate policy input.