A flaw was found in Apache Neethi. A remote attacker could exploit this vulnerability by sending a specially crafted WS-Policy document containing deeply nested policy elements. This crafted document can bypass the parser's nesting-depth limit, leading to uncontrolled recursion that exhausts the thread stack. Successful exploitation results in a denial of service, causing the parser to crash.
Last checked: 2026-09-24 21:23 UTC
No exploitation evidence · CISA Coordinator (Assessed 2026-09-21 13:35 UTC)
Fix evidence last checked: 2026-10-02 16:54 UTC