CVE-2026-42403 Overview
CVE-2026-42403 is a denial-of-service vulnerability in Apache Neethi, the WS-Policy framework used by Apache CXF, Axis2, and other Java SOAP stacks. The flaw stems from missing cycle detection during policy normalization. When a WS-Policy document contains circular references, where Policy A references Policy B which references Policy A, Neethi enters an infinite loop or unbounded recursion. The result is a stack overflow or application hang. An unauthenticated attacker can submit a crafted policy document over the network to exhaust resources on the target service. The Apache Neethi maintainers fixed the issue in version 3.2.2.
Critical Impact
Unauthenticated remote attackers can trigger application hangs or stack overflows in any service that parses untrusted WS-Policy documents through Apache Neethi, taking SOAP/web services offline.
Affected Products
- Apache Neethi versions prior to 3.2.2
- Apache CXF deployments that consume untrusted WS-Policy documents through Neethi
- Apache Axis2 and other Java SOAP stacks that embed Neethi for policy processing
Discovery Timeline
- 2026-05-01 - CVE-2026-42403 published to NVD
- 2026-05-01 - Apache Software Foundation publishes advisory on the Apache Mailing List Thread
- 2026-05-01 - Issue announced on OpenWall OSS-Security Update
- 2026-05-01 - Last updated in NVD database
Technical Details for CVE-2026-42403
Vulnerability Analysis
Apache Neethi assembles, normalizes, and merges WS-Policy assertions for SOAP-based services. The normalization step expands policy references (<wsp:PolicyReference>) into their target policy definitions. The vulnerable code path does not track which policies it has already visited during expansion. A policy graph that contains a cycle therefore causes the normalizer to recurse or iterate without terminating.
The weakness is classified as Uncontrolled Resource Consumption [CWE-400]. Depending on the JVM stack size and the depth of recursion, the process either throws StackOverflowError and terminates the request thread, or consumes CPU indefinitely while holding request resources. Repeated requests deplete the worker pool and render the SOAP endpoint unresponsive.
Root Cause
The root cause is the absence of a visited-set or depth limit in Neethi's policy reference resolution logic. WS-Policy permits one policy to reference another by URI, and a well-formed document tree should be acyclic. Neethi trusted that property rather than enforcing it, so cyclic input bypasses any safety check.
Attack Vector
Exploitation requires only network access to an endpoint that ingests attacker-controlled WS-Policy XML. No authentication or user interaction is needed. The attacker submits a SOAP request or policy attachment in which two or more <wsp:Policy> elements reference each other through <wsp:PolicyReference URI="..."/>. When Neethi normalizes the policy, the cycle triggers the denial-of-service condition. Confidentiality and integrity are not affected; only availability is impacted.
No public proof-of-concept or exploit is currently listed for this CVE. See the Apache Mailing List Thread for the maintainer description.
Detection Methods for CVE-2026-42403
Indicators of Compromise
- Repeated StackOverflowError entries in application logs originating from org.apache.neethi classes during policy parsing.
- Worker threads stuck in Policy.normalize or PolicyReference.normalize frames visible in thread dumps.
- SOAP endpoints returning HTTP 500 or timing out after receiving requests that include <wsp:PolicyReference> elements.
Detection Strategies
- Inventory Java services for the neethi-*.jar artifact and flag any version below 3.2.2 using software composition analysis.
- Inspect inbound SOAP and WS-MetadataExchange traffic for policy documents containing multiple <wsp:PolicyReference> URIs that resolve to one another.
- Alert on sustained CPU saturation or thread-pool exhaustion correlated with WS-Policy processing on CXF or Axis2 hosts.
Monitoring Recommendations
- Capture JVM thread dumps automatically when CPU stays above a defined threshold and review for recursive Neethi frames.
- Forward application logs to a centralized analytics platform and build a query for StackOverflowError plus neethi to identify exploitation attempts.
- Monitor request latency and error rates per SOAP operation to detect availability degradation early.
How to Mitigate CVE-2026-42403
Immediate Actions Required
- Upgrade Apache Neethi to version 3.2.2 or later in every affected service.
- Rebuild and redeploy downstream products such as Apache CXF and Axis2 against the patched Neethi release.
- Restrict network exposure of WS-Policy-consuming endpoints to trusted clients until patching is complete.
Patch Information
The Apache Software Foundation released Apache Neethi 3.2.2 to address this issue. The fix adds proper cycle detection to the policy normalization routine so that circular PolicyReference chains are rejected instead of recursed. Refer to the Apache Mailing List Thread and the OpenWall OSS-Security Update for upgrade guidance.
Workarounds
- Place an XML-aware gateway or WAF in front of SOAP services and reject documents containing more than one <wsp:PolicyReference> element pointing to a policy that itself contains a <wsp:PolicyReference>.
- Reduce the JVM thread stack size cautiously and enforce request timeouts so that a runaway normalization terminates quickly rather than holding worker threads.
- Require authentication and mutual TLS on WS-Policy endpoints to limit who can submit policy documents while patching is in progress.
# Verify the Neethi version shipped inside a deployed application
unzip -p app.war WEB-INF/lib/neethi-*.jar META-INF/MANIFEST.MF | grep -i Bundle-Version
# Maven dependency override to force the patched release
# pom.xml
# <dependency>
# <groupId>org.apache.neethi</groupId>
# <artifactId>neethi</artifactId>
# <version>3.2.2</version>
# </dependency>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
