Slow-Read DoS in Apache Neethi: Remote Policy Fetch Lacks Total Timeout (< 3.2.4)
AI analysis
Apache Neethi, a Java library for processing WS-Policy documents, applies a timeout to each individual read when fetching a remotely referenced policy, but sets no deadline on the transfer as a whole. A malicious or compromised policy server can exploit this by trickling bytes just fast enough to keep resetting the per-read timer, holding the fetch open indefinitely and permanently tying up the calling application's thread, which is a denial of service. Exploitation requires an application built on a vulnerable Neethi version to resolve a policy from an attacker-controlled or attacker-influenced URL, so the impact depends on how the library is used rather than on Neethi alone. The flaw is fixed in Apache Neethi 3.2.4. There is no known public proof of concept, no evidence of exploitation in the wild, and the CVE is not in CISA's KEV catalog.
What to do: Upgrade the org.apache.neethi:neethi dependency to 3.2.4 wherever it appears in your dependency tree (for example, mvn dependency:tree | grep neethi, including transitive pulls via web-service stacks). Until upgraded, avoid resolving policies from untrusted or user-supplied URLs, whitelist allowed policy locations, and enforce upstream request timeouts or circuit breakers so a stalled fetch cannot exhaust worker threads.
Affected
| Apache Neethi | all versions prior to 3.2.4 (fixed in 3.2.4) |
Estimated exposure
—No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slowly can keep the fetch alive indefinitely and tie up the calling thread (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.