AI analysis
Apache Neethi, the Java library used to parse WS-Policy documents in SOAP web-service stacks, fails to properly enforce its nesting-depth limit, allowing a specially crafted WS-Policy document with deeply nested policy elements to trigger uncontrolled recursion and exhaust the thread stack, crashing the parser. An attacker who can get a vulnerable application to parse a malicious policy document — for example a SOAP service that processes untrusted WS-Policy attachments or fetched WSDL/policy files — gains a denial-of-service condition only; there is no indication of code execution or data exposure. Any application embedding a Neethi version older than 3.2.4 is affected, and because Neethi is usually pulled in as a transitive dependency of frameworks such as Apache CXF, Axis2, and WSS4J, many maintainers may not realize they ship it. There is no public proof of concept, the issue is not in the CISA Known Exploited Vulnerabilities catalog, and no exploitation in the wild has been reported.
What to do: Upgrade the Neethi dependency to 3.2.4, and check for bundled/transitive copies (e.g., mvn dependency:tree or your SBOM) since the library usually arrives via CXF, Axis2, or WSS4J rather than as a direct dependency. If upgrading is not immediately possible, stop parsing WS-Policy or WSDL from untrusted sources and restrict which endpoints can submit policy documents; note that raising the thread stack size (-Xss) only raises the crash threshold and is not a fix. Monitor parser threads for StackOverflowError as an indicator of attempted exploitation.
Affected
| Apache Software Foundation Apache Neethi | all versions prior to 3.2.4 (< 3.2.4) |
Estimated exposure
moderate≈1,000s–10,000s of enterprise Java deployments, indirectly (crude estimate; no direct counts exist) — Neethi is an embedded library with no public install or scan metrics, so exposure was estimated from its role as a transitive dependency of widely deployed enterprise SOAP stacks (CXF, Axis2, WSS4J), restricted further to the subset of…
Description
A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread stack, crashing the parser (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.