Neethi
Monthly
Denial of service in Apache Neethi before 3.2.4 lets unauthenticated remote attackers pin CPU for extended periods by supplying a crafted pair of WS-Policy documents to an application that runs them through Neethi's policy-intersection logic. The flaw is an uncontrolled resource-consumption issue (CWE-770) in which a small, carefully constructed input drives exponential work, and CISA's SSVC framework rates it automatable; no public exploit code has been identified at time of analysis. Per the assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), confidentiality and integrity are untouched and scope is unchanged, so practical exposure is limited to SOAP/web-services deployments that actually intersect untrusted, client-supplied policy documents.
Denial of service in Apache Neethi before 3.2.4 allows unauthenticated remote attackers to exhaust server CPU and memory by submitting a small WS-Policy document that contains repeated policy references, which Neethi re-expands exponentially during normalization. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), with impact limited to availability - there is no confidentiality or integrity loss. Practical exposure is bounded: only applications that actually parse and normalize attacker-supplied WS-Policy (typically SOAP/web-service endpoints built on Apache Axis2 or CXF) are reachable, and no public exploit identified at time of analysis. This is a genuine but bounded availability risk, and upgrading to 3.2.4 removes the flaw.
Heap exhaustion in Apache Neethi versions before 3.2.4 lets unauthenticated remote attackers exhaust server memory by submitting a crafted WS-Policy document whose oversized policy assertion is copied into memory without being counted against Neethi's size limits, resulting in denial of service. The issue is availability-only (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and reachable only where an application actually parses attacker-supplied WS-Policy input, most commonly SOAP endpoints built on Apache Axis2 or CXF. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV), so the practical risk is bounded by whether untrusted WS-Policy documents reach the parser.
Stack exhaustion in Apache Neethi before 3.2.4 lets an unauthenticated remote attacker crash the WS-Policy parser by supplying a policy document whose element nesting is deep enough to slip past Neethi's nesting-depth guard and drive unbounded recursion until the thread stack is exhausted. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) the impact is availability-only: no confidentiality or integrity loss, but a successful parse failure can take down the parser thread and potentially the hosting SOAP endpoint. The practical reachability condition is that the target application must actually hand attacker-controlled WS-Policy content to Neethi - typical of Apache Axis2 or CXF-based WS-* services that accept client- or peer-supplied policy - whereas deployments that only parse locally configured, trusted policy are not exposed; no public exploit code was identified at time of analysis and neither CISA KEV nor EPSS data accompanies this record.
Denial of service in Apache Neethi (org.apache.neethi:neethi) before 3.2.4 allows a malicious or compromised remote policy server to stall a WS-Policy fetch indefinitely, tying up the calling thread for as long as the server keeps trickling bytes. Deployments are exposed only where an application uses Neethi to resolve a remote PolicyReference over HTTP; applications that consume locally embedded or bundled policy documents are not affected. The issue is availability-only (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), rated moderate severity, and no public exploit identified at time of analysis.
Denial of service in Apache Neethi before 3.2.4 lets unauthenticated remote attackers pin CPU for extended periods by supplying a crafted pair of WS-Policy documents to an application that runs them through Neethi's policy-intersection logic. The flaw is an uncontrolled resource-consumption issue (CWE-770) in which a small, carefully constructed input drives exponential work, and CISA's SSVC framework rates it automatable; no public exploit code has been identified at time of analysis. Per the assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), confidentiality and integrity are untouched and scope is unchanged, so practical exposure is limited to SOAP/web-services deployments that actually intersect untrusted, client-supplied policy documents.
Denial of service in Apache Neethi before 3.2.4 allows unauthenticated remote attackers to exhaust server CPU and memory by submitting a small WS-Policy document that contains repeated policy references, which Neethi re-expands exponentially during normalization. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), with impact limited to availability - there is no confidentiality or integrity loss. Practical exposure is bounded: only applications that actually parse and normalize attacker-supplied WS-Policy (typically SOAP/web-service endpoints built on Apache Axis2 or CXF) are reachable, and no public exploit identified at time of analysis. This is a genuine but bounded availability risk, and upgrading to 3.2.4 removes the flaw.
Heap exhaustion in Apache Neethi versions before 3.2.4 lets unauthenticated remote attackers exhaust server memory by submitting a crafted WS-Policy document whose oversized policy assertion is copied into memory without being counted against Neethi's size limits, resulting in denial of service. The issue is availability-only (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and reachable only where an application actually parses attacker-supplied WS-Policy input, most commonly SOAP endpoints built on Apache Axis2 or CXF. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV), so the practical risk is bounded by whether untrusted WS-Policy documents reach the parser.
Stack exhaustion in Apache Neethi before 3.2.4 lets an unauthenticated remote attacker crash the WS-Policy parser by supplying a policy document whose element nesting is deep enough to slip past Neethi's nesting-depth guard and drive unbounded recursion until the thread stack is exhausted. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) the impact is availability-only: no confidentiality or integrity loss, but a successful parse failure can take down the parser thread and potentially the hosting SOAP endpoint. The practical reachability condition is that the target application must actually hand attacker-controlled WS-Policy content to Neethi - typical of Apache Axis2 or CXF-based WS-* services that accept client- or peer-supplied policy - whereas deployments that only parse locally configured, trusted policy are not exposed; no public exploit code was identified at time of analysis and neither CISA KEV nor EPSS data accompanies this record.
Denial of service in Apache Neethi (org.apache.neethi:neethi) before 3.2.4 allows a malicious or compromised remote policy server to stall a WS-Policy fetch indefinitely, tying up the calling thread for as long as the server keeps trickling bytes. Deployments are exposed only where an application uses Neethi to resolve a remote PolicyReference over HTTP; applications that consume locally embedded or bundled policy documents are not affected. The issue is availability-only (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), rated moderate severity, and no public exploit identified at time of analysis.