Description

A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread stack, crashing the parser (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-21T12:17:24.697Z",
  "pubdate": "2026-09-21T12:17:24.697Z",
  "executiveSummary": "A critical denial-of-service (DoS) vulnerability has been identified in the Neethi library involving the processing of WS-Policy documents.\nThe vulnerability stems from inadequate recursive depth limitations when parsing nested policy elements within an XML-based WS-Policy document.\nAn unauthenticated, remote attacker can exploit this by submitting a maliciously crafted policy document containing an excessively deep hierarchy of nested elements.\nSuccessful exploitation triggers a stack overflow condition within the underlying thread, leading to a termination of the processing thread or a complete crash of the application using the Neethi parser.\nThe vulnerability poses significant risk to service availability for applications relying on Neethi for policy enforcement, potentially leading to persistent outages if the malicious input is cached or re-processed.\nImpact is categorized as a high-severity denial-of-service attack, as it does not require authentication or specific privilege levels to trigger the stack exhaustion.",
  "technicalDetails": "The vulnerability is located within the XML parsing logic of the Neethi library, specifically in how the component handles recursive descent during the traversal of WS-Policy document object models.\nWhen the Neethi parser encounters deeply nested XML elements defined within a WS-Policy document, it invokes recursive function calls to traverse the policy tree structure.\nThe application lacks an explicit, secure depth-limiting mechanism or a bounded stack allocation strategy for these recursive operations. Consequently, a specially crafted input document with an arbitrarily high level of nested policy elements forces the parser to exceed the thread's stack capacity, resulting in a StackOverflowError.\nAttack Flow: 1. The attacker prepares a WS-Policy document containing an exhaustive, deeply nested structure (e.g., thousands of child policy elements). 2. The attacker transmits this document to the vulnerable service endpoint via protocols supported by the integrated Neethi library. 3. The Neethi parser initiates the recursive parsing process upon receiving the request. 4. As the parser descends through the layers of nesting, the thread's stack memory usage grows linearly until it surpasses the allocated stack size limit. 5. The Java Virtual Machine (JVM) throws a StackOverflowError, causing the execution thread to crash.\nThis vulnerability is inherent to the parsing component responsible for transforming XML configuration into actionable policy objects. Because the validation logic for element depth is absent or insufficient in versions prior to 3.2.4, the parser cannot proactively reject malicious payloads that exceed reasonable nesting thresholds.\nThe impact is strictly denial-of-service; while this exploit does not facilitate arbitrary code execution or privilege escalation, it effectively disables the security framework or service endpoint reliant on the library. Since the parsing occurs early in the request processing lifecycle, the vulnerability can often be triggered prior to any authentication checks or business logic processing, increasing its exposure in public-facing services.\nThe vulnerability is patched in version 3.2.4, which introduces a limit to the permitted recursion depth during the parsing phase, effectively mitigating the risk of stack exhaustion regardless of the input document's complexity."
}