CVE-2026-42402
Denial of Service in Apache Neethi via WS-Policy Normalization
Publication date: 2026-05-01
Last updated on: 2026-05-01
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | neethi | to 3.2.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-400 | The product does not properly control the allocation and maintenance of a limited resource. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in Apache Neethi causes a Denial of Service (DoS) through memory exhaustion but does not impact confidentiality, integrity, or availability of data directly. Since it does not lead to data breaches or unauthorized data access, its effect on compliance with standards like GDPR or HIPAA, which focus on protecting personal and sensitive data, is indirect and limited.
However, a DoS attack causing service unavailability could potentially affect availability requirements under these regulations if critical services are disrupted for extended periods.
Can you explain this vulnerability to me?
Apache Neethi is vulnerable to a Denial of Service (DoS) attack caused by algorithmic complexity during the policy normalization process.
When specially crafted WS-Policy documents are processed, they can trigger an exponential Cartesian cross-product expansion, which leads to unbounded memory allocation.
This excessive expansion causes the Java Virtual Machine (JVM) heap memory to be exhausted, resulting in runtime memory exhaustion and potential service disruption.
How can this vulnerability impact me? :
This vulnerability can cause a Denial of Service (DoS) condition by exhausting the JVM heap memory during the processing of WS-Policy documents.
As a result, affected applications using Apache Neethi may crash or become unresponsive, leading to service outages and potential downtime.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, users should upgrade Apache Neethi to version 3.2.2, which limits the maximum number of normalized policy alternatives and prevents unbounded memory allocation during policy normalization.