Apache Neethi vulnerabilities

Apache Neethi does not properly detect circular references in policy definitions. Circular references in WS-Policy documents can lead to an infinite loop or excessive recursion, resulting in a stack overflow or application hang.

Apache Neethi is vulnerable to a Denial of Service attack due to algorithmic complexity in policy normalization. Specially crafted WS-Policy documents can trigger an exponential Cartesian cross-product expansion during the normalization process, leading to unbounded memory allocation and JVM heap exhaustion.

Denial of service vulnerability in Apache Neethi when manually retrieving remote policy references via API. Retrieving a huge policy can cause resource exhaustion. Fixed in version 3.2.3 by imposing a default maximum data size.

Bypass of the maximum number of normalized policy alternatives in Apache Neethi 3.2.2 via crafted policies, potentially leading to DoS via resource consumption. Fixed in version 3.2.3.

Uncontrolled recursion vulnerability in Apache Neethi when parsing policies without IDs or with deeply nested structures, leading to DoS via memory exhaustion. Fixed in version 3.2.3.