AI analysis
Apache Neethi, a Java library that processes WS-Policy documents, fails to guard against exponentially expensive re-expansion of policy references during normalization. An attacker can submit a small, deliberately crafted WS-Policy document containing repeated references to the same policy, causing Neethi to re-expand those references exponentially and exhaust CPU and memory, hanging or crashing the parsing process. The attacker gains only a denial of service, not code execution or data access, but any service that parses untrusted WS-Policy input with an affected Neethi version is at risk. The issue is fixed in Apache Neethi 3.2.4, and there is no evidence of exploitation in the wild and no public proof of concept.
What to do: Upgrade Apache Neethi to 3.2.4, or force the upgraded version in your dependency tree if it arrives transitively (e.g., via your WS-SecurityPolicy/WS-* stack). If you cannot upgrade immediately, ensure your application does not normalize WS-Policy documents from untrusted or unauthenticated sources, and set CPU/memory limits or timeouts on policy parsing. Audit dependency trees for any neethi artifacts below 3.2.4.
Affected
| Apache Neethi | All versions prior to 3.2.4 (< 3.2.4) |
Estimated exposure
—No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.