Apache Neethi processes WS‑Policy documents. A policy that contains repeated references can cause Neethi to recursively expand those references exponentially during normalization, consuming large amounts of CPU and memory. This flaw is classified as a resource exhaustion weakness (CWE‑770) and involves improper resource handling (CWE‑776). The result is a denial‑of‑service condition in which the Neethi component, and potentially any application that incorporates it, becomes unresponsive.

The flaw affects all Apache Neethi releases older than version 3.2.4. Systems that load or normalize WS‑Policy documents without applying limits on reference complexity are vulnerable. This includes Java‑based web service stacks that rely on Neethi for policy processing.

The CVSS score of 7.5 reflects a high severity denial‑of‑service vulnerability. The EPSS score of <1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack can be triggered remotely by sending a crafted WS‑Policy document to any service that employs Neethi for policy normalization. No special privileges are required, and the attack can be performed over the standard web service interface.