AI analysis
Apache Neethi, a Java library used to parse WS-Policy documents in SOAP/WS-* web service stacks, fails to enforce its element and attribute size limits on content nested inside a policy assertion. An attacker who can supply a specially crafted WS-Policy document (for example, an untrusted WSDL or policy attachment fed to a service that parses it with Neethi) can cause the library to copy unlimited content into memory, exhausting the heap. The result is denial of service — application slowdown or crash from out-of-memory conditions — with no indication of code execution or data exposure. Any application embedding a Neethi version prior to 3.2.4 is affected, which most commonly means enterprise SOAP stacks and products that bundle the library transitively. There is no public proof of concept, the flaw is not in CISA's KEV catalog, and no exploitation has been reported.
What to do: Upgrade Apache Neethi to 3.2.4 if you consume the library directly; if it arrives transitively via a downstream product (e.g., a SOAP/web-services framework), apply that vendor's update once it ships a fixed Neethi version. As an interim mitigation, only parse WS-Policy documents and WSDLs from trusted sources, cap the accepted size of submitted policy/WSDL input, and monitor JVM heap usage for unexplained growth during policy processing.
Affected
| Apache Software Foundation Apache Neethi | all versions prior to 3.2.4 (e.g., 3.2.3 and earlier) |
Estimated exposure
unknown — embedded library; affected host count depends on downstream products that bundle Neethi (enterprise SOAP/WS-Policy stacks), which no public scan or… — Neethi is a build-time Java dependency rather than a deployed appliance or plugin, so there is no reliable install-base or internet-exposure figure to anchor an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its size limits, exhausting the heap (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.