Apache Neethi EUVD-2026-83885

Exploitation requires that the target application actually parse an attacker-supplied WS-Policy document with Apache Neethi before 3.2.4 - typically a SOAP/WS-* service built on Apache Axis2 or CXF that accepts and processes client- or peer-provided policy assertions. The single crafted input is a policy document whose element nesting exceeds Neethi's depth guard, which the flaw allows to slip past into unbounded recursion. No authentication, no user interaction, and no non-default toggle is named in the advisory (AV:N/AC:L/PR:N/UI:N), so against a service that reaches Neethi's policy parser with untrusted input it is remotely reachable; the practical limiting factor is that many deployments only parse trusted, locally-configured policy, which removes the untrusted-input path entirely.

All available signals are consistent and point to a genuine but availability-only risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) indicates a remote, unauthenticated, low-complexity attack with no confidentiality or integrity impact - pure denial of service, which matches CWE-674 (Uncontrolled Recursion) and the description of a thread-stack exhaustion parser crash. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or weaponization; the elevated 7.5 is driven entirely by the unauthenticated network reach, not by breadth of impact. This is a real patch-worthy defect for anyone parsing untrusted WS-Policy documents, but it is not a top-tier emergency: a single crashed parser thread/process is recoverable, there is no data exposure, and real exposure is gated on whether the deploying application actually feeds attacker-supplied policy documents to Neethi. No signals conflict; the main missing datum is exploitation telemetry (EPSS/KEV/POC all absent), so ranking should lean on deployment exposure rather than exploitation likelihood.

An attacker sends a specially crafted WS-Policy document with policy elements nested far deeper than Neethi's intended limit to a SOAP/WS-* endpoint (e.g. an Apache Axis2 or CXF service) that parses client-supplied policy. The malformed nesting bypasses the depth guard and drives unbounded recursion until the thread stack overflows, crashing the parser and denying service. No authentication or user interaction is required and no public exploit code is currently identified.