The vulnerability arises when a specially crafted WS-Policy document includes an assertion with unlimited content. Neethi copies this content into heap memory without enforcing its size limits, causing the process to exhaust available memory. The result is a denial‑of‑service condition that can bring affected applications or services down. This flaw is a maximum memory consumption weakness (CWE‑770).

Apache Neethi, versions prior to 3.2.4 are susceptible; upgrading to 3.2.4 eliminates the issue.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation yet. However, the memory exhaustion attack path is straightforward for an attacker who can supply a crafted WS-Policy to a Neethi‑powered endpoint. The impact is a complete denial of service for the target application. Due to the lack of mitigation controls in unpatched versions, the risk remains high.