A specially crafted pair of WS-Policy documents can cause Apache Neethi’s policy-intersection routine to perform an exponential amount of work, tying up the CPU for extended periods. This uncontrolled resource-consumption flaw (CWE-770) and the logic flaw that leads to an infinite loop (CWE-1333) together create a denial-of-service condition that blocks legitimate traffic and exhausts system resources.

The vulnerability resides in Apache Neethi libraries before version 3.2.4. Any application, service, or component that imports or processes WS-Policy documents using an unpatched Neethi package is affected, regardless of whether it is a client or server.

Inferred attack vector: a remote attacker can trigger the flaw by sending crafted WS-Policy documents to any endpoint that processes them, without requiring authentication or privileged access. The CVSS score of 7.5 indicates high severity, and the EPSS score of <1% indicates a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, but the potential impact remains significant for networks exposed to arbitrary policy payloads.