CVE-2026-91865: Exponential Resource Consumption in Apache Neethi WS-Policy Normalization

Summary

CVE-2026-91865 is a high-severity denial-of-service vulnerability in Apache Neethi, a WS-Policy framework used widely across Apache web service projects. A small WS-Policy document containing repeated policy references can force Neethi to re-expand the same references exponentially during its normalization process, consuming massive amounts of CPU and memory. The vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling) and carries a CVSS 3.1 base score of 7.5. Users are advised to upgrade to version 3.2.4, which addresses this issue.

Technical Analysis

Apache Neethi is a framework for processing WS-Policy documents as defined by the W3C WS-Policy specification. WS-Policy provides a flexible and extensible grammar for expressing the capabilities, requirements, and general characteristics of entities in an XML Web Services-based system. Neethi is used internally by several Apache projects, most notably Apache CXF, to parse, normalize, and merge policy documents during web service interactions.

The core of this vulnerability lies in Neethi’s normalization engine. When Neethi processes a WS-Policy document, it resolves policy references — elements that point to other policy definitions within the same document or externally. Normalization is the process by which Neethi expands these references, merges policy alternatives, and produces a canonical form of the policy.

The vulnerability arises because Neethi does not impose limits on how many times a policy reference can be re-expanded during normalization. A crafted WS-Policy document can include repeated references to the same policy definitions in a way that causes exponential re-expansion. Each reference resolution can trigger further reference resolutions, creating a multiplicative effect. The result is that a very small input document — potentially just a few kilobytes — can cause Neethi to consume enormous amounts of CPU time and memory as it attempts to fully normalize the policy.

The CVSS 3.1 vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Breaking this down:

Attack Vector (AV:N): Network — the vulnerability can be exploited remotely over a network connection, which is the natural attack surface for web service endpoints that accept WS-Policy documents.
Attack Complexity (AC:L): Low — the attack requires no special conditions and can be executed with a straightforward crafted policy document.
Privileges Required (PR:N): None — no authentication or elevated privileges are needed to submit a WS-Policy document to a vulnerable endpoint.
User Interaction (UI:N): None — the exploit does not require any user interaction.
Scope (S:U): Unchanged — the vulnerability affects the same security authority as the vulnerable component.
Confidentiality (C:N): None — the vulnerability does not allow unauthorized access to information.
Integrity (I:N): None — the vulnerability does not allow modification of data.
Availability (A:H): High — the vulnerability causes a complete denial of service by exhausting system resources.

The CWE-770 classification (Allocation of Resources Without Limits or Throttling) is precisely appropriate here. Neethi allocates CPU and memory resources during normalization without any mechanism to limit or throttle the expansion of policy references. There is no maximum depth, no reference count limit, and no resource budget enforced during the normalization process.

This class of vulnerability is sometimes referred to as an algorithmic complexity attack or a resource amplification attack. The key characteristic is that the computational cost of processing the input grows super-linearly — in this case, exponentially — with respect to the input size. A linear increase in the number of policy references in the document produces an exponential increase in the work required to normalize it. This asymmetry between input size and processing cost is what makes the attack so efficient: the attacker invests very little bandwidth and payload size to extract a disproportionately large amount of server-side computation.

Affected Software and Versions

The vulnerability affects Apache Neethi. Based on the description, users are recommended to upgrade to version 3.2.4, which fixes this issue. This indicates that all versions of Apache Neethi prior to 3.2.4 are vulnerable to this denial-of-service condition.

Because Neethi is a library rather than a standalone application, the practical attack surface extends to every application and framework that embeds Neethi for WS-Policy processing. Apache CXF, one of the most widely deployed web service frameworks in the Java ecosystem, is a notable consumer of Neethi. Any application built on Apache CXF or other frameworks that include a vulnerable version of Neethi as a transitive dependency may be exposed to this vulnerability.

Organizations should check their dependency trees for the org.apache.neethi:neethi artifact and verify whether the resolved version is below 3.2.4. In Maven-based projects, this can be done using the mvn dependency:tree command. In Gradle-based projects, the gradle dependencies task serves the same purpose. Given that Neethi may be pulled in transitively through multiple dependency paths, a thorough dependency analysis is recommended.

Impact

The impact of CVE-2026-91865 is a denial of service. An attacker who can submit a WS-Policy document to a service that processes it through a vulnerable version of Apache Neethi can cause that service to consume excessive CPU and memory, potentially leading to:

Service unavailability: The targeted web service endpoint becomes unresponsive while Neethi attempts to normalize the malicious policy document. The exponential expansion can consume all available CPU cores and memory.
Application crash: Memory exhaustion can trigger OutOfMemoryError exceptions in the JVM, crashing the application entirely and requiring a restart.
Resource starvation: Even if the application does not crash, other requests to the same server may be delayed or dropped due to resource contention, affecting legitimate users.
Cascading failures: In microservice architectures, the unavailability of one service can cascade to dependent services, amplifying the impact beyond the initially targeted component.
Sustained outage: Because the attack payload is small and the processing time is long, an attacker can maintain a denial-of-service condition with minimal ongoing effort, simply by sending additional crafted documents as needed.

The CVSS score of 7.5 reflects the high availability impact combined with the ease of exploitation — network-accessible, low complexity, no privileges required, and no user interaction needed. However, the absence of confidentiality and integrity impact means the vulnerability cannot be leveraged for data theft or unauthorized modification. The threat is purely to availability, but in environments where service uptime is critical, the business impact can be severe.

Exploitation Scenario

The following scenario is illustrative and derived from the vulnerability description. It is intended to help defenders understand the attack pattern.

Consider an organization running a SOAP-based web service built on Apache CXF. The service exposes endpoints that accept SOAP messages and processes WS-Policy attachments as part of message handling. An attacker discovers this endpoint during reconnaissance — for example, by identifying a WSDL endpoint, observing WS-SecurityPolicy headers in SOAP responses, or finding documentation that indicates the service uses WS-Policy for configuration.

The attacker crafts a small WS-Policy XML document that contains multiple policy definitions and repeated policy references pointing to those definitions. The references are structured so that resolving one reference triggers the resolution of others, creating an exponential expansion pattern during Neethi’s normalization phase. The document itself is small — perhaps only a few kilobytes — making it easy to transmit and difficult to detect through simple size-based filtering or rate limiting.

The attacker submits this document to the web service endpoint, either as part of a SOAP message, as a policy attachment, or through any interface that causes Neethi to parse and normalize the policy. When Neethi begins normalization, it starts expanding the policy references. Due to the repeated and interlocking nature of the references, each expansion step multiplies the work required for subsequent steps. The CPU usage spikes, memory consumption grows rapidly, and the service becomes unresponsive.

Because the attack requires only a single small request and no authentication, it can be executed quickly and repeated as needed to maintain the denial-of-service condition. The attacker does not need to sustain a high-volume flood of traffic — a single well-crafted policy document may be sufficient to incapacitate the service for an extended period, as the normalization process may take minutes or longer to complete or until the JVM exhausts memory.

Detection and Mitigation

Detection

Detecting exploitation of this vulnerability requires monitoring for abnormal resource consumption correlated with WS-Policy processing:

CPU and memory monitoring: Watch for sudden, unexplained spikes in CPU usage or memory consumption on servers running Java applications that process web services. A single request triggering near-100% CPU utilization across multiple cores is a strong indicator.
JVM monitoring: Monitor for OutOfMemoryError exceptions in application logs, particularly java.lang.OutOfMemoryError: Java heap space or GC overhead limit exceeded.
Request inspection: Inspect incoming requests for WS-Policy documents containing an unusually high number of PolicyReference elements, especially references that point to the same policy definitions repeatedly.
Response time monitoring: Track response times for web service endpoints. A dramatic increase in latency for a specific endpoint may indicate that Neethi is spending excessive time normalizing a policy document.
Thread dump analysis: During a suspected attack, capture JVM thread dumps and look for threads stuck in Neethi normalization code, particularly in classes related to policy reference expansion and alternative merging.

Mitigation

Upgrade Neethi: The primary and most effective mitigation is to upgrade Apache Neethi to version 3.2.4 or later, which fixes the vulnerability. This may require updating the parent framework (such as Apache CXF) to a version that bundles the patched Neethi.
Input validation: As a temporary measure, implement input filtering or validation that rejects WS-Policy documents containing an excessive number of policy references or deeply nested reference chains. This is a partial mitigation and may not cover all exploitation variants.
Resource limits: Configure JVM resource limits, request timeouts, and thread pool constraints to limit the impact of a denial-of-service attempt. While this does not fix the underlying vulnerability, it can reduce the blast radius.
WAF rules: Deploy web application firewall rules that inspect incoming XML payloads for patterns consistent with malicious WS-Policy documents, such as a high count of wsp:PolicyReference elements relative to document size.
Network access controls: Restrict access to web service endpoints that process WS-Policy documents to trusted networks or authenticated clients where possible, reducing the attack surface.

Bug Bounty Angle

For bug bounty hunters and offensive security researchers, CVE-2026-91865 represents an interesting class of vulnerability: algorithmic complexity attacks against XML processing libraries. Here are key considerations for hunting similar issues:

Target identification: Look for applications that process SOAP web services, WS-Security policies, or any endpoint that accepts WS-Policy documents. Apache CXF-based applications are prime targets since CXF uses Neethi internally. Check for ?wsdl endpoints, SOAP endpoints, and services that advertise WS-Policy support.
Dependency analysis: When testing a Java application, attempt to identify the Neethi version in use. This can sometimes be determined from error messages, stack traces, or by examining the application’s classpath. If the version is below 3.2.4, the application is likely vulnerable.
Payload crafting: The key to exploiting this vulnerability is crafting a WS-Policy document with repeated policy references that cause exponential expansion. Experiment with different patterns of PolicyReference elements that reference the same policy definitions in interlocking ways. The goal is to maximize the normalization work per byte of input.
Beyond Neethi: This vulnerability pattern — unbounded resource consumption through recursive or exponential reference expansion — is not unique to Neethi. Look for similar issues in other XML processing libraries, policy engines, and template expansion systems. Any component that resolves references without depth or count limits is a candidate.
Impact demonstration: When reporting this class of vulnerability, demonstrate the impact clearly by showing CPU and memory consumption metrics before and after sending the crafted payload. Include timing data to show how a single small request can cause prolonged unavailability.
Program scope: Check whether the bug bounty program’s scope covers availability and denial-of-service findings. Some programs exclude DoS vulnerabilities or require specific handling procedures. Always review the program rules before testing.
Responsible testing: Denial-of-service testing carries inherent risk of disrupting production services. Use staging or test environments where possible, and coordinate with the program owner. A single crafted request may be sufficient to demonstrate the vulnerability without needing to sustain an actual outage.

Frequently Asked Questions

What is CVE-2026-91865?

CVE-2026-91865 is a denial-of-service vulnerability in Apache Neethi. A crafted WS-Policy document with repeated policy references can cause exponential resource consumption during normalization, leading to high CPU and memory usage. The vulnerability has a CVSS score of 7.5 and is classified as CWE-770.

Which versions of Apache Neethi are affected?

The description recommends upgrading to version 3.2.4, which fixes the issue. This indicates that versions prior to 3.2.4 are vulnerable. Organizations should verify their dependency trees for the org.apache.neethi:neethi artifact version.

How can I fix this vulnerability?

Upgrade Apache Neethi to version 3.2.4 or later. If Neethi is used as a transitive dependency through a framework such as Apache CXF, update the framework to a version that includes the patched Neethi release.

Does this vulnerability allow data theft or code execution?

No. The CVSS vector indicates no impact on confidentiality or integrity. The vulnerability solely affects availability by causing excessive CPU and memory consumption, resulting in denial of service.