Description

A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-21T12:17:24.903Z",
  "pubdate": "2026-09-21T12:17:24.903Z",
  "executiveSummary": "A critical algorithmic complexity vulnerability exists within the Neethi library, specifically concerning the processing of WS-Policy documents.\nThe vulnerability allows for a Denial of Service (DoS) attack through the exploitation of nested or repeated policy references.\nBy crafting a specially constructed WS-Policy document, an attacker can force the normalization engine to undergo exponential recursive expansion.\nThis behavior results in excessive consumption of system resources, including CPU cycles and heap memory, ultimately leading to service instability or process termination.\nThe flaw affects Neethi versions prior to 3.2.4 and represents a significant risk to applications relying on WS-Policy for security and configuration enforcement.\nExploitation does not necessarily require authentication, as the attack vector involves the parsing of user-supplied or externally fetched policy documents.\nThe primary risk implication is the degradation or total loss of service availability for the affected middleware or application component.",
  "technicalDetails": "The vulnerability originates in the Neethi normalization logic when handling nested policy references within a WS-Policy XML structure. The component is responsible for expanding these references to create a flattened, canonical representation of the policy for enforcement.\nThe root cause of this issue is an inefficient recursive algorithm that fails to track or limit the depth and frequency of reference expansion. When a policy document contains multiple or recursive references to the same internal policy elements, the normalization engine attempts to resolve each reference independently during the flattening process.\nThe attack flow begins when an attacker supplies a malicious WS-Policy document to an application using the vulnerable Neethi library. Upon parsing, the normalization process encounters the repeated references. As the engine evaluates these references, the workload grows exponentially rather than linearly with the number of references. This is a classic example of an algorithmic complexity attack, often referred to as a 'Billion Laughs' variant applied to WS-Policy.\nDuring the exploitation, the CPU usage spikes to 100% as the engine repeatedly copies and traverses the expanding policy tree. Simultaneously, memory usage increases rapidly as the normalized model is constructed in memory, potentially leading to an OutOfMemory (OOM) error that triggers a JVM crash or renders the application unresponsive.\nThe vulnerability is present in versions of Neethi prior to 3.2.4. Because WS-Policy parsing is often an early-stage operation in Web Services stacks (such as Apache CXF), an attacker can trigger this vulnerability without needing valid credentials or deep application access, provided the service endpoint accepts policy-driven requests.\nThe attack does not result in code execution or data exfiltration but is strictly a resource-exhaustion vulnerability. Once the normalization process is triggered, the impact is immediate denial of service for the target instance, requiring a restart of the application service to recover."
}