Apache Neethi EUVD-2026-83887

Exploitation requires that the target application uses Apache Neethi (versions before 3.2.4) to parse and NORMALIZE a WS-Policy document supplied by the attacker - in practice a SOAP/web-service endpoint built on Apache Axis2 or CXF that accepts and processes client-provided WS-Policy. The trigger is a small document containing repeated policy references that Neethi re-expands exponentially during normalization. No authentication, user interaction, or non-default toggle is stated as required (PR:N/UI:N), but real exposure is limited to services that actually normalize untrusted/external policy documents; internal-only or non-policy-processing deployments are not reachable, and upgrading to 3.2.4 removes the flaw.

This is a genuine but bounded availability risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) indicates a remote, unauthenticated, low-complexity attack with no confidentiality or integrity impact - a pure denial-of-service via algorithmic complexity (CWE-770). No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or automated weaponization; the score is driven entirely by the reachability metrics rather than by observed real-world abuse. The realistic priority is moderate: the flaw only matters if an application actually normalizes untrusted or client-supplied WS-Policy documents, so the network-reachability implied by AV:N is conditional on how the embedding application (typically Apache Axis2/CXF SOAP stacks) exposes policy processing. Signals are internally consistent (all point to availability-only DoS) with no conflicts to resolve; the main gap is the absence of exploit-probability data (EPSS) and any exploitation evidence, which supports treating this as patch-in-normal-cycle rather than emergency-remediation for most deployments.

An attacker submits a small, crafted WS-Policy document containing repeated policy references to a SOAP/web-service endpoint that uses Apache Neethi to normalize incoming policies. During normalization Neethi re-expands the same references exponentially, pinning CPU and exhausting memory so the service becomes unresponsive to legitimate users. No authentication or user interaction is required, but no public exploit code was identified at time of analysis.