Apache Neethi Denial-of-Service Vulnerability via Unbounded Resource Allocation in Policy Normalization

A denial-of-service vulnerability has been identified in Apache Neethi versions prior to 3.2.2. The issue arises from algorithmic complexity in the policy normalization process, where specially crafted WS-Policy documents can cause an exponential increase in memory usage. This occurs due to an unbounded Cartesian cross-product expansion, leading to excessive policy alternatives being generated and ultimately exhausting the JVM heap. Users are advised to upgrade to version 3.2.2, which addresses this issue by limiting the maximum number of normalized policy alternatives.

Impact

Exploitation of this vulnerability leads to unbounded memory allocation, causing runtime memory exhaustion and exhausting the JVM heap.

Remediation

Users should upgrade to Apache Neethi version 3.2.2 or later.