Apache Neethi processes WS policy documents. When a policy does not include a policy ID or contains deeply nested structures, the recursion that resolves policy references expands without limit, eventually exhausting the JVM heap and causing the application to become unresponsive. The weakness is classified as CWE‑400 and allows an attacker who can supply such a policy document to trigger a denial‑of‑service condition by exhausting memory.

All builds of Apache Neethi prior to version 3.2.3 are vulnerable. Any application that imports policy documents with the library, including web services frameworks, must consider this risk if it processes untrusted policy input.

The CVSS score of 7.5 indicates a high severity for service disruption. The EPSS score of less than 1% signals a low probability of exploitation in the current threat landscape, and the vulnerability is not listed in CISA’s KEV catalog. An attacker would need to supply a crafted policy that lacks a policy ID or has excessive nesting depth—delivery could occur through any channel that feeds policy documents to the library, such as network endpoints that accept policy uploads, administrative consoles, or file‑based inputs. Based on typical usage patterns, these channels are inferred but not explicitly stated in the CVE entry.