Description

A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its size limits, exhausting the heap (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-21T12:17:24.807Z",
  "pubdate": "2026-09-21T12:17:24.807Z",
  "executiveSummary": "This vulnerability involves an uncontrolled resource consumption flaw within the Neethi library, specifically triggered during the processing of WS-Policy documents.\nThe vulnerability allows an unauthenticated attacker to supply a specially crafted policy assertion containing an unlimited volume of data, which the library attempts to load into memory without enforcing internal size constraints.\nThe primary impact of this flaw is a Denial of Service (DoS) resulting from heap exhaustion, which forces the host application to crash or become unresponsive due to excessive memory allocation.\nThe vulnerability affects Neethi versions prior to 3.2.4. Successful exploitation requires an attacker to transmit a malicious WS-Policy document to an endpoint that parses such files using the vulnerable Neethi component.\nGiven the nature of the flaw, it presents a significant risk to the availability of systems relying on Neethi for policy processing, as it permits remote, unauthenticated actors to induce resource depletion with minimal complexity.\nOrganizations utilizing affected versions of Neethi are strongly encouraged to prioritize upgrading to version 3.2.4 or later to implement the necessary input validation checks.",
  "technicalDetails": "The root cause of this vulnerability lies in an improper input validation mechanism within the Neethi library during the parsing of WS-Policy XML documents.\nWhen a WS-Policy document is processed, the library identifies and extracts content contained within policy assertions. Due to a deficiency in the logic responsible for handling these assertions, the library fails to perform size-based bounds checking before allocating memory for the parsed content.\nAn attacker can exploit this by injecting an excessively large payload within a policy assertion element. When the library attempts to process this assertion, it copies the entire payload into the heap without validating its length against predefined memory limits.\nThe attack flow begins when an attacker sends a malicious SOAP or XML message containing the crafted WS-Policy assertion to a service utilizing the vulnerable Neethi library. Upon receipt, the application invokes the Neethi parser to resolve the policy.\nThe parser enters an unbounded copy operation where the malicious payload is stored in application memory. Repeated submissions of such payloads, or a single sufficiently massive payload, lead to rapid heap consumption, eventually triggering an OutOfMemoryError or causing the underlying JVM to stall due to continuous Garbage Collection (GC) pressure.\nThis vulnerability is particularly critical because the processing of policy assertions occurs early in the request lifecycle, often before high-level authentication or authorization checks are finalized, thereby exposing the internal memory state to unauthenticated remote attackers.\nThe lack of sanitization or size-limiting controls on the inbound data stream allows the attacker to influence the heap usage directly. Because the application logic does not impose a maximum buffer size or depth limit on the policy structure, the heap space is exhausted, resulting in a total Denial of Service for the application instance.\nThis behavior is consistent with an 'Improper Restriction of Excessive Allocation' pattern, where the lack of defensive constraints on input parameters directly facilitates system instability."
}