CVE-2026-42402: Apache Neethi DOS Vulnerability

CVE-2026-42402 Overview

CVE-2026-42402 is a denial of service vulnerability in Apache Neethi, a library that processes WS-Policy documents for web service frameworks. The flaw resides in the policy normalization routine. Specially crafted WS-Policy documents trigger an exponential Cartesian cross-product expansion during normalization. The expansion produces unbounded policy alternatives and exhausts the Java Virtual Machine (JVM) heap.

Apache addressed the issue in Neethi 3.2.2 by capping the maximum number of normalized policy alternatives. The vulnerability is tracked under [CWE-400] Uncontrolled Resource Consumption and is exploitable remotely without authentication or user interaction.

Critical Impact
Unauthenticated attackers can crash any service that parses untrusted WS-Policy XML using Apache Neethi by sending a single crafted document that exhausts the JVM heap.

Affected Products

Apache Neethi versions prior to 3.2.2
Apache CXF and other web service stacks that embed vulnerable Neethi releases
Java applications processing untrusted WS-Policy documents through Neethi

Discovery Timeline

2026-05-01 - CVE-2026-42402 published to the National Vulnerability Database
2026-05-01 - Apache project announcement posted to the Apache mailing list and OSS-Security
2026-05-01 - Last updated in NVD database

Technical Details for CVE-2026-42402

Vulnerability Analysis

Apache Neethi normalizes WS-Policy documents into Disjunctive Normal Form (DNF) so policy alternatives can be evaluated independently. The conversion to DNF requires distributing nested <wsp:ExactlyOne> and <wsp:All> operators across one another. When an attacker nests these operators repeatedly, the number of resulting alternatives grows as the Cartesian product of the children at each level.

A modestly sized input document with several layers of nesting produces millions of alternative Policy objects in memory. Each allocation consumes JVM heap until an OutOfMemoryError terminates the application. The defect falls under [CWE-400] Uncontrolled Resource Consumption and reflects a classic algorithmic complexity attack against a parser that lacks bounds on intermediate state.

Root Cause

The normalization routine in versions prior to 3.2.2 did not enforce a ceiling on the number of policy alternatives generated during DNF expansion. The implementation walked the policy tree and materialized every combinatorial alternative without checking memory pressure or alternative counts. Patch 3.2.2 introduces a maximum threshold and rejects inputs that exceed it.

Attack Vector

Exploitation requires only the ability to submit a WS-Policy document to a service that uses Neethi for normalization. Common entry points include SOAP endpoints exposed by Apache CXF, WS-MetadataExchange responses, and any custom integration that calls Neethi.getNormalizedPolicy() on attacker-controlled XML. The attacker crafts a policy with deeply nested alternation and conjunction nodes whose expanded form produces an exponential number of alternatives, then submits it over HTTP.

No verified public exploit code is available at the time of publication. The vulnerability mechanism is documented in the Apache Mailing List Discussion and the OpenWall OSS-Security Update.

Detection Methods for CVE-2026-42402

Indicators of Compromise

Java processes terminating with java.lang.OutOfMemoryError: Java heap space originating in org.apache.neethi stack frames
Sudden growth of resident memory in services hosting Apache CXF or other Neethi consumers, followed by unresponsiveness
Inbound HTTP requests carrying SOAP or WS-Policy payloads with deeply nested <wsp:ExactlyOne> and <wsp:All> elements
Repeated 5xx responses or connection resets from WS-Policy aware endpoints after small bursts of inbound traffic

Detection Strategies

Inspect application logs and JVM crash dumps for OutOfMemoryError events with stack traces referencing Policy.normalize or PolicyEngine
Deploy a Web Application Firewall rule that flags WS-Policy documents exceeding a reasonable nesting depth or element count
Inventory Java applications and dependency manifests to enumerate vulnerable Neethi versions across the estate

Monitoring Recommendations

Track JVM heap utilization and garbage collection pause time on services that process WS-Policy input
Alert on a rising rate of HTTP 500 responses or process restarts on SOAP endpoints
Capture and review inbound XML payload sizes and structural metrics for anomalies relative to normal baselines

How to Mitigate CVE-2026-42402

Immediate Actions Required

Upgrade Apache Neethi to version 3.2.2 in all applications and dependent frameworks
Identify transitive dependencies on Neethi through tools such as mvn dependency:tree or Software Composition Analysis scanners
Restrict network access to SOAP and WS-Policy endpoints to authenticated and trusted clients while patching is in progress
Enforce request size limits on XML payloads at the ingress proxy or API gateway

Patch Information

Apache Neethi 3.2.2 introduces a hard limit on the number of normalized policy alternatives produced during DNF expansion. Documents that would exceed this limit are rejected before memory exhaustion occurs. Coordinate the upgrade with downstream consumers such as Apache CXF that bundle Neethi, and rebuild artifacts that pin a vulnerable version. Refer to the Apache Mailing List Discussion for release details.

Workarounds

Reject WS-Policy documents from untrusted sources at the edge using XML schema or structural validation
Cap inbound XML element counts and nesting depth in the SOAP stack configuration
Lower the JVM heap ceiling on isolated workers so a single malicious request cannot consume shared resources, while accepting that requests will still fail

bash

# Maven dependency upgrade example
mvn versions:use-dep-version \
  -Dincludes=org.apache.neethi:neethi \
  -DdepVersion=3.2.2 \
  -DforceVersion=true

# Verify the resolved version
mvn dependency:tree -Dincludes=org.apache.neethi:neethi