The flaw exists in Apache Neethi, where the PolicyReference API does not validate the URI that it fetches. An application that explicitly calls the API can cause an outbound request to any protocol and address, including internal IP ranges. This allows an attacker to exfiltrate data, scan internal services, or pivot through the application’s network permissions. The underlying weak point is documented as CWE-918, which describes an unrestricted redirect or redirection that can be abused for unintended communication.

The vulnerability affects the Apache Neethi component of the Apache Software Foundation. All versions prior to 3.2.2 are impacted, because 3.2.2 introduced restrictions limiting the accepted URI scheme to http/https only and removes link‑local, multicast, and any‑local addresses. No specific patch level is listed beyond the recommendation to upgrade to 3.2.2.

The CVSS score of 6.5 denotes moderate severity. EPSS information is not available, and the issue is not listed in the CISA KEV catalog. Attackers would need an application that calls the PolicyReference API with a crafted URI; once triggered, the application deems the address trusted and initiates a network connection. This lack of input validation can lead to internal network exposure, lateral movement, or other outward‑bound data leakage, especially in environments with unrestricted outbound connectivity.