A crafted WS‑Policy document containing deeply nested policy elements can bypass Apache Neethi’s intended nesting‑depth limit and cause the parser to recurse until the thread stack is exhausted, leading to a crash. The result is a denial‑of‑service condition for the application or service processing the document. The weakness is uncontrolled recursion that results in resource exhaustion.

Apache Neethi, supplied by the Apache Software Foundation, is affected on all releases earlier than version 3.2.4. Users of Neethi that rely on it to parse WS‑Policy documents are vulnerable unless they upgrade to 3.2.4 or later.

Because the vulnerability only manifests when a specially crafted WS‑Policy document is parsed, the attacker must be able to submit such a document to a Neethi‑based service. The CVSS score is 7.5, and the EPSS score indicates an exploitation probability of less than 1%. The denial‑of‑service nature combined with the fact that the vulnerability is not listed in the CISA KEV catalog suggests a lower likelihood of widespread exploitation, but exposed services remain at risk of localized disruption if a malicious document is sent.