A high-severity denial of service vulnerability in Apache Neethi allows unauthenticated attackers to crash the parser via malicious WS-Policy documents.

This vulnerability involves a failure to properly enforce nesting-depth limits within the WS-Policy parser. An unauthenticated attacker can exploit this by submitting a specially crafted policy document to trigger a stack exhaustion condition.

The exploitation of this vulnerability results in a denial of service, which can cause significant operational disruption by rendering the affected service unavailable. With a CVSS score of 7.5, the risk is elevated because the attack vector is network-based and requires no authentication, allowing for remote exploitation by any entity capable of sending a policy document to the component.

Immediate Action: Upgrade to Apache Neethi version 3.2.4 or later to implement the corrected nesting-depth enforcement.

Proactive Monitoring: Monitor application logs for frequent stack overflow errors or unexpected parser crashes that may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an input validation layer to filter and reject malformed or excessively complex XML/WS-Policy documents before they reach the parser.

Public Exploit Available: No (exploit_available: false)

This vulnerability presents a clear risk to service availability through remote, unauthenticated exploitation. Given the availability of a patch, organizations should prioritize the update to version 3.2.4 across all environments to eliminate the risk of parser-level denial of service attacks.