Apache Neethi fetches remote policy references but limits only the time per read operation. An attacker or a misbehaving server can deliver data so slowly that the client thread remains blocked indefinitely, tying up system resources and effectively denying service to legitimate requests. The vulnerability does not expose sensitive data or allow code execution; its primary consequence is availability disruption.

The issue affects Apache Neethi deployments that rely on remote policy references. All versions prior to the released fix in 3.2.4 are vulnerable; no specific minor versions were listed as unaffected.

Exploitation requires the attacker to control or induce a slow responding policy server that the client contacts. The CVSS score of 4.3 indicates a low‑to‑moderate severity. Because the EPSS score is not available, the likelihood of exploitation cannot be precisely quantified; however, when policy fetching is frequent, a hanging request could significantly impact availability. The vulnerability is not listed in the CISA KEV catalog and no public exploits are known.