Description

When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slowly can keep the fetch alive indefinitely and tie up the calling thread (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-21T12:17:25.107Z",
  "pubdate": "2026-09-21T12:17:25.107Z",
  "executiveSummary": "The vulnerability identified in Neethi constitutes an improper resource management flaw, specifically a Denial of Service (DoS) vulnerability arising from insufficient timeout controls during remote policy reference retrieval.\nThe issue stems from a logic error where timeout constraints are applied strictly to individual read operations rather than the aggregate duration of the entire data transfer process.\nThis design limitation allows a malicious or compromised remote server to maintain an open connection indefinitely by trickling data at an extremely slow rate, effectively circumventing per-read timeout mechanisms.\nSuccessful exploitation results in the exhaustion of the calling thread pool, potentially leading to a complete application-level Denial of Service as system resources become saturated by stalled connections.\nThis vulnerability affects Neethi versions prior to 3.2.4 and requires no special authentication, as an attacker can trigger the vulnerability by providing a crafted remote reference URL that points to a malicious or controlled endpoint.\nThe risk is critical for applications that rely on external policy fetching, as the resource exhaustion can be achieved with minimal effort from a remote attacker, potentially impacting the availability of the broader service ecosystem.",
  "technicalDetails": "The root cause of the vulnerability lies in the implementation of the remote policy fetch mechanism within the Neethi library. The logic fails to enforce a comprehensive 'total transfer' timeout, opting instead for a granular 'per-read' timeout.\nIn a standard networking stack, when a stream is being consumed, a read timeout typically resets or triggers only when the underlying socket fails to provide data within a specific interval. If an attacker controls the remote endpoint, they can manipulate the TCP window size or artificially throttle the data transmission rate to send one byte every few seconds, just fast enough to reset the read-timeout timer without completing the overall request.\nThe attack flow proceeds as follows: First, an attacker identifies a function call in Neethi that fetches a remote policy reference. Second, the attacker configures an HTTP or similar protocol server to respond to the request. Third, the server initiates the response but intentionally delays the delivery of the payload body by injecting significant latency between packets. Because Neethi monitors the health of the connection via individual read operations rather than the lifecycle of the entire transfer, the thread responsible for the fetch remains blocked indefinitely.\nThis behavior ties up the calling thread in a wait-state. In high-concurrency environments, an attacker can initiate multiple concurrent requests, causing a thread pool exhaustion. Once the thread pool is fully consumed by these stalled connections, the application becomes unable to process legitimate requests, leading to a system-wide Denial of Service.\nThe vulnerability is present in versions of Neethi prior to 3.2.4. It does not require authentication or elevated privileges, provided the attacker can influence the policy reference URL. The network exposure is broad, as any system performing remote policy resolution is susceptible if it connects to an attacker-controlled or malicious server. There is no complex payload required for exploitation; the impact is purely resource-based, leading to unavailability rather than arbitrary code execution."
}