GitHub Advisoryadvisory · Maven

GHSA-g36m-9g3m-2vmp Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalization

HIGH Published 2026-05-01 Modified 2026-05-07 Official page ↗
Aliases
CVE-2026-42402
Ecosystem
Maven
Packages
org.apache.neethi:neethi
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2026-05-07

Affected packages

• Maven org.apache.neethi:neethi: < 3.2.2 → fixed in 3.2.2

Description

Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalization. Specially crafted WS-Policy documents can trigger an exponential Cartesian cross-product expansion during the normalization process, causing unbounded memory allocation that exhausts the JVM heap. This occurs when the normalization process generates an excessive number of policy alternatives without bounds, leading to runtime memory exhaustion. Users should upgrade to 3.2.2 which limits the maximum number of normalized policy alternatives.

Related

Alias · CVE (1)

  • CVE-2026-42402 Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalization. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References