Description

A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU for a long time (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-21T12:17:25.000Z",
  "pubdate": "2026-09-21T12:17:25.000Z",
  "executiveSummary": "This vulnerability involves an algorithmic complexity issue within the Neethi library's policy-intersection logic. Specifically, the library is susceptible to a Denial of Service (DoS) attack when processing maliciously crafted WS-Policy documents.\nBy submitting two specially crafted policy files, an attacker can trigger exponential computational overhead during the intersection process, resulting in prolonged CPU pinning.\nThe vulnerability affects the Neethi library, leading to resource exhaustion. Because the CPU becomes dedicated to resolving the intersection, the application becomes unable to process legitimate traffic or maintain service availability.\nThis issue does not require specialized privileges or authentication to execute, provided the attacker can submit input to the policy processing engine. Successful exploitation results in complete service degradation or failure until the process is terminated or the computation concludes.\nThis risk is high for systems that utilize Neethi for automated policy negotiation, as it allows unauthenticated remote actors to cause significant resource strain on the host environment.\nThe recommended remediation is to upgrade to version 3.2.4 or later, which contains the necessary algorithmic optimizations to prevent exponential complexity during policy intersection.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the policy intersection algorithm within the Neethi framework. In the context of WS-Policy, an intersection operation is designed to determine the set of policy alternatives that are compatible between two distinct policies.\nWhen processing two complex, specially crafted WS-Policy documents, the intersection logic enters a state of exponential complexity. The algorithm fails to efficiently manage the state space of nested policy alternatives, leading to a combinatorial explosion of the search tree.\nThe attack flow begins when an attacker provides two carefully structured WS-Policy documents as input to the component using Neethi. When the system initiates an intersection operation, the library attempts to iterate through every possible combination of policy alternatives between the two documents.\nDue to the specific structure of the crafted payloads, the number of operations required grows exponentially relative to the size and nesting depth of the policy expressions. This forces the CPU to dedicate all available cycles to the resolution process, effectively locking the thread or process involved in the calculation.\nThe vulnerable component is identified within the core intersection logic responsible for comparing policy alternatives. Since Neethi is often used in infrastructure-level middleware, this vulnerability impacts any application service reliant on WS-Policy for configuring security, transport, or transactional assertions.\nThe exploitation does not require the attacker to have administrative privileges or prior authentication. Exposure is restricted to the network reachability of the policy-accepting interface. Once triggered, the payload behavior manifests as a total block on the thread executing the intersection, leading to thread pool exhaustion if multiple requests are processed, ultimately cascading into a Denial of Service for the entire application.\nPost-exploitation, the service remains in a state of resource starvation until the CPU-intensive task completes or the process is killed. There is no evidence of remote code execution; the impact is strictly limited to availability disruption via resource depletion."
}