An uncontrolled resource consumption vulnerability in Apache Neethi allows unauthenticated remote attackers to trigger a denial of service condition via crafted policy documents.

This is an uncontrolled resource consumption flaw categorized as CWE-400, triggered when processing WS-Policy documents containing circular references that lead to infinite recursion or application hangs, requiring no authentication.

A successful exploit results in service disruption, rendering applications dependent on Apache Neethi unresponsive. This causes availability loss for critical business functions. The CVSS score of 7.5 reflects the high impact on service availability combined with network vector access and low attack complexity.

Immediate Action: Update Maven/org.apache.neethi:neethi to version 3.2.2 or later.

Proactive Monitoring: Monitor application logs for abnormal thread counts, memory spikes, or recurring stack overflow errors during policy parsing operations.

Compensating Controls: Implement input validation rules at the application boundary to inspect incoming WS-Policy documents for recursive structures before passing them to the parser.

Public Exploit Available: false

Organizations utilizing Apache Neethi must prioritize upgrading to version 3.2.2 to eliminate the infinite loop vector. Applying this patch promptly prevents potential denial of service attacks against dependent systems.