Apache Neethi EUVD-2026-83886

Exploitation requires a service that uses Apache Neethi (versions before 3.2.4) to parse an attacker-supplied WS-Policy document - typically a SOAP endpoint built on Apache Axis2 or CXF that accepts and normalizes untrusted client WS-Policy input. No authentication or user interaction is needed (PR:N/UI:N), and the crafted assertion bypasses Neethi's size limits because oversized assertion content is copied into memory without being counted. The limiting factor is exposure: deployments that never parse untrusted/external WS-Policy documents (internal-only or non-WS-Policy SOAP configurations) are not reachable. Impact is availability-only (heap/memory exhaustion); no data disclosure or modification results.

All signals converge on a genuine but bounded availability-only issue. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is internally consistent with the description: a network-reachable, unauthenticated, low-complexity parse of a crafted WS-Policy document that exhausts the heap. There is no confidentiality or integrity impact - this is pure denial of service (A:H). No EPSS score, no CISA KEV listing, and no public POC are present in the provided intelligence, so there is no evidence of active or automated exploitation; the 7.5 is driven entirely by unauthenticated network reach, not by demonstrated in-the-wild abuse. The practical risk is gated by exposure rather than by attacker skill: Neethi is a WS-Policy library embedded in SOAP stacks (Apache Axis2/CXF), so it is only reachable where an endpoint accepts and parses attacker-supplied WS-Policy documents. Treat as a real-but-moderate patch-in-normal-cycle item unless a service exposes WS-Policy parsing to untrusted clients, in which case it should be prioritized. No conflicting signals in the data; the main missing element is EPSS/exploit telemetry.

An attacker sends a single specially crafted WS-Policy document to a SOAP service that uses Neethi (e.g. via Axis2 or CXF) to parse policy. The document packs unlimited content inside a policy assertion that Neethi copies into memory without counting it toward its size limits, driving the JVM heap to exhaustion and crashing or hanging the service. No authentication or user interaction is required; no public POC is referenced, but the low-complexity, unauthenticated network vector makes reproduction straightforward.