Apache Neethi vulnerabilities

Denial of service vulnerability in Apache Neethi when manually retrieving remote policy references via API. Retrieving a huge policy can cause resource exhaustion. Fixed in version 3.2.3 by imposing a default maximum data size.

Bypass of the maximum number of normalized policy alternatives in Apache Neethi 3.2.2 via crafted policies, potentially leading to DoS via resource consumption. Fixed in version 3.2.3.

Uncontrolled recursion vulnerability in Apache Neethi when parsing policies without IDs or with deeply nested structures, leading to DoS via memory exhaustion. Fixed in version 3.2.3.

Apache Neethi does not restrict URIs when manually fetching remote policy references through the PolicyReference API. An application can make outbound requests to arbitrary protocols and internal IP addresses. From version 3.2.2, only http/https URIs are allowed and link-local/multicast/any-local addresses are forbidden.

Apache Neethi does not properly detect circular references in policy definitions. Circular references in WS-Policy documents can lead to an infinite loop or excessive recursion, resulting in a stack overflow or application hang.

Apache Neethi is vulnerable to a Denial of Service attack due to algorithmic complexity in policy normalization. Specially crafted WS-Policy documents can trigger an exponential Cartesian cross-product expansion during the normalization process, leading to unbounded memory allocation and JVM heap exhaustion.