AIKIDO-2026-10687
neethi is vulnerable to Uncontrolled Resource Consumption
75
High Risk
This Affects:
neethiTL;DR
Algorithmic complexity in policy normalization in Apache Neethi allows specially crafted WS-Policy documents to trigger an exponential Cartesian cross-product expansion, resulting in unbounded memory allocation. This can exhaust the JVM heap and cause application crashes, leading to a denial of service (dos) vulnerability. Version 3.2.2 introduces limits on the number of normalized policy alternatives to prevent uncontrolled resource consumption.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
neethi is vulnerable to Uncontrolled Resource Consumption in versions 0.0.1 - 3.2.1.
How to fix this
Upgrade the org.apache.neethi:neethi library to the patch version.
Links
github.com/apache/ws-neethi/compare/neethi-3.2.1...neethi-3.2.2
lists.apache.org/thread/p826j0phhmr9f83wzpmys1y0bdfrr2q4openwall.com/lists/oss-security/2026/05/01/6
Get Secure Now
Secure your code, cloud, and runtime environments in one central system. Find and fix vulnerabilities automatically.
No credit card required | Scan results in 32secs.
SOC 2Compliant
ISO 27001Compliant