Denial of Service Vulnerability in Apache Neethi Affecting Memory Allocation

CVE-2026-42402

What is CVE-2026-42402?

Apache Neethi exhibits a vulnerability that can be exploited to execute a Denial of Service attack due to its handling of WS-Policy documents. The flaw arises from the algorithmic complexity during the policy normalization process, which can lead to the system exhausting its memory. When specially crafted WS-Policy documents are processed, they can trigger an exponential increase in the number of normalized policy alternatives, pushing the JVM heap to its limits. Users are advised to upgrade to version 3.2.2 to mitigate this issue, as this version enforces a cap on the maximum number of normalized policy alternatives.

References