EUVD-2026-83888
GHSA-q84r-gp7c-vfr3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach WS-Policy endpoint using Neethi
-
DeliverySubmit crafted WS-Policy document pair
-
ExploitTrigger exponential policy-intersection computation
-
ExecutionCPU pinned / resources exhausted
-
ImpactService denial for legitimate users
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target application to invoke Apache Neethi's policy-intersection logic on attacker-controllable WS-Policy documents - i.e., a SOAP/web-services endpoint (typically via Apache Axis2 or CXF) that accepts and intersects client-supplied WS-Policy input. Per the CVSS vector it is remote, unauthenticated, and needs no user interaction (AV:N/PR:N/UI:N), and SSVC rates it automatable. The practical limiter is exposure: deployments that never intersect untrusted/client-provided policy documents are not reachable, and impact is confined to availability (C:N/I:N) with no scope change (S:U). Versions before 3.2.4 are affected; upgrading to 3.2.4 remediates. |
| Impact | Signals are internally consistent and point to a genuine but availability-only concern. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a remote, low-complexity, unauthenticated attack with high availability impact and no confidentiality or integrity loss - an algorithmic-complexity denial of service, consistent with CWE-770 (and arguably more precisely CWE-407, algorithmic complexity). The SSVC framework reinforces a measured priority: Exploitation is 'none' (no observed or public exploitation), Automatable is 'yes' (sending crafted policy documents is trivially scriptable), and Technical Impact is 'partial' - matching a resource-exhaustion DoS rather than code execution. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no evidence of active exploitation or weaponized code; the risk is theoretical-but-credible. This is a real fix-worthy issue for exposed SOAP/WS-Policy endpoints but not a drop-everything emergency: the 7.5 is driven by the unauthenticated network reach, while the actual impact ceiling is service disruption, not data compromise. Key limiter not captured by the raw score: exploitation depends on the application actually feeding attacker-controlled WS-Policy documents into Neethi's intersection routine. |
| Exploit ScenarioDerived | An attacker submits a specially crafted pair of WS-Policy documents to a SOAP web service that uses Apache Neethi to compute policy intersection. Neethi performs exponential work evaluating them, pinning CPU cores and starving the service of resources, degrading or denying availability for legitimate clients. No public exploit code is identified in the available data, but the attack is unauthenticated, network-reachable, and easily automated per the SSVC 'Automatable: yes' assessment. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 21, 2026
Denial of service in Apache Neethi before 3.2.4 lets unauthenticated remote attackers pin CPU for extended periods by supplying a crafted pair of WS-Policy documents to an application that runs them through Neethi's policy-intersection logic. The flaw is an uncontrolled resource-consumption issue (CWE-770) in which a small, carefully constructed input drives exponential work, and CISA's SSVC framework rates it automatable; no public exploit code has been identified at time of analysis. Per the assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), confidentiality and integrity are untouched and scope is unchanged, so practical exposure is limited to SOAP/web-services deployments that actually intersect untrusted, client-supplied policy documents.
Earlier versions of this analysis (1)
Denial of service in Apache Neethi (org.apache.neethi:neethi) before 3.2.4, where a specially crafted pair of WS-Policy documents drives the policy-intersection routine into an exponential amount of computation and pins CPU for an extended period. The vulnerability is remotely reachable without authentication (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), but exploitation requires that a consuming application actually performs policy intersection against at least one attacker-supplied policy document - typically a SOAP/WS-* stack such as Apache CXF, Axis2, or WSS4J negotiating client policy against its own. No CISA KEV entry and no public exploit code have been identified at time of analysis, no EPSS score or NVD vector is available, and the ASF-assigned severity is 'moderate'; deployments that only intersect trusted, internally authored policies are not reachable by untrusted input. The issue was discovered through agent-assisted security study of open-source projects rather than reported exploitation.
RemediationAI
Upgrade Apache Neethi to 3.2.4, the vendor-released patch that bounds the policy-intersection computation; this is the only fully effective fix and is the action recommended in the advisory at https://ws.apache.org/ and the announcement at https://lists.apache.org/thread/zbfxnomgvbmqchqjgc6lk5h0z76k3gh4 (see also https://seclists.org/oss-sec/2026/q3/832). Where an immediate upgrade is not possible, the highest-value compensating control is to stop passing attacker-controllable WS-Policy documents into intersection - configure the SOAP runtime (Axis2/CXF) to use a trusted, server-side policy set rather than negotiating against client-supplied policy, accepting the trade-off that dynamic policy negotiation and some WS-SecurityPolicy exchange scenarios will no longer function. If interoperation requires client policy, cap the complexity and size of accepted policy documents at the front end (element count, nesting depth, alternative count) and reject oversized inputs before they reach the Neethi library, with the side effect that legitimately verbose but benign policies may be refused. Applying aggressive per-request CPU/thread timeouts and request rate limits on the SOAP endpoint shortens the duration and frequency of any single CPU pin, but because the failure mode is a spiky, request-bound resource burn rather than sustained traffic, timeouts will also fail some long-running legitimate intersections and rate limits reduce overall endpoint throughput. Concurrency limiting or per-tenant thread quotas on the affected endpoint provide additional containment while accepting reduced peak capacity. Note that these controls are mitigations only and do not address the underlying exponential algorithm.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Neethi is the Apache Web Services implementation of WS-Policy, the XML framework that describes the capabilities, requirements and constraints (security, reliability, addressing, MTOM) of a SOAP service, and it is consumed by stacks such as Apache Axis2 and Apache CXF to perform policy intersection - the operation that determines whether two policy alternatives are compatible. The vulnerability lies in that intersection routine: when presented with a specifically crafted pair of policy documents, the algorithm's work grows exponentially rather than polynomially, so a comparatively compact input produces a disproportionate, long-running CPU burn. CWE-770 (Allocation of Resources Without Limits or Throttling) captures the root-cause class - the intersection computation consumes CPU without any bound on iterations, depth, or document complexity, allowing a single request to monopolize a worker thread. The affected range per EUVD is Apache Neethi 0 through versions below 3.2.4; no CPE strings were supplied in the source data, so product identification here relies on the EUVD version range and the vendor advisory rather than on NVD CPE matching. Because the flaw is purely algorithmic efficiency and does not corrupt or disclose data, the resulting vector is availability-only with no scope change.
Know when Neethi gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated submission of crafted policy documents (AV:N/AC:L/PR:N/UI:N) causes CPU-exhaustion DoS with no data impact, so A:H and C:N/I:N.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
5Description PRE-NVD
Articles & Coverage 2
Executive ViewAI
Apache Neethi versions prior to 3.2.4 contain a high-severity denial-of-service vulnerability that unauthenticated attackers can exploit to exhaust CPU resources on affected SOAP-based web services. Organizations that process untrusted WS-Policy documents through Neethi's policy-intersection logic are at risk of service degradation or downtime, potentially disrupting business operations and partner integrations. Leadership should prioritize patching exposed systems to maintain availability and avoid reputational harm.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Stack exhaustion in Apache Neethi before 3.2.4 lets an unauthenticated remote attacker crash the WS-Policy parser by sup
Denial of service in Apache Neethi before 3.2.4 allows unauthenticated remote attackers to exhaust server CPU and memory
Heap exhaustion in Apache Neethi versions before 3.2.4 lets unauthenticated remote attackers exhaust server memory by su
Denial of service in Apache Neethi (org.apache.neethi:neethi) before 3.2.4 allows a malicious or compromised remote poli
Exploit-DB