CVE-2026-66142 Overview
Apache Neethi contains an uncontrolled recursion vulnerability [CWE-400] in its policy parsing logic. The flaw is triggered when the library processes WS-Policy documents that omit policy identifiers or contain deeply nested policy structures. Parsing such input causes recursive expansion that exhausts runtime memory, producing a denial of service condition on the host application. Any service that consumes untrusted WS-Policy input through Apache Neethi is exposed. The Apache Software Foundation has released version 3.2.3 to address the issue.
Critical Impact
Remote unauthenticated attackers can crash services that parse WS-Policy documents by submitting malformed or deeply nested policies, resulting in application-wide denial of service.
Affected Products
- Apache Neethi versions prior to 3.2.3
- Applications embedding Apache Neethi for WS-Policy parsing
- Downstream Apache projects (for example, Apache CXF, Axis2) that ship or depend on vulnerable Neethi releases
Discovery Timeline
- 2026-07-24 - CVE-2026-66142 published to NVD
- 2026-07-27 - Last updated in NVD database
Technical Details for CVE-2026-66142
Vulnerability Analysis
Apache Neethi is a Java library that implements the WS-Policy specification. It parses XML policy documents into internal object representations that downstream SOAP frameworks use for message-level security and reliable messaging. The library's parser walks nested policy elements recursively without enforcing depth limits or safe defaults for missing identifiers.
An attacker who can submit a crafted policy document forces the parser into unbounded recursion. Each recursive call allocates stack frames and heap objects representing intermediate policy nodes. Deeply nested wsp:Policy, wsp:All, and wsp:ExactlyOne structures compound this behavior, and policies lacking an explicit policy Id reach code paths that never terminate cleanly. The result is runtime memory exhaustion or a StackOverflowError, terminating the hosting Java Virtual Machine (JVM) or dependent request threads.
The attack requires no authentication or user interaction and can be delivered across the network wherever a service accepts external WS-Policy input.
Root Cause
The root cause is missing recursion depth enforcement and missing validation for policies without identifiers in Neethi's policy builder path. The parser trusts caller-supplied document structure and expands nested references without a bounded work budget, satisfying the pattern described by [CWE-400: Uncontrolled Resource Consumption].
Attack Vector
An attacker sends a SOAP request or WSDL reference containing an embedded policy document with excessive nesting or a missing policy Id. When the target service loads the policy through Neethi during message processing or service initialization, the recursive parser consumes memory until the JVM fails. Repeated requests keep the service unavailable.
No verified proof-of-concept code is publicly available. Refer to the Apache Mailing List Thread and the Openwall OSS Security Update for the maintainer advisory.
Detection Methods for CVE-2026-66142
Indicators of Compromise
- Repeated OutOfMemoryError or StackOverflowError entries in application logs originating from org.apache.neethi classes.
- Sudden JVM heap growth or thread termination correlated with inbound SOAP or WSDL traffic containing WS-Policy elements.
- HTTP requests carrying unusually large or deeply nested wsp:Policy XML fragments.
Detection Strategies
- Inspect application server logs for stack traces referencing org.apache.neethi.builders or PolicyBuilder during request handling.
- Deploy XML-aware inspection on ingress that flags policy documents exceeding a configured nesting depth or size threshold.
- Inventory Java dependencies with a Software Composition Analysis (SCA) tool to identify Neethi versions earlier than 3.2.3.
Monitoring Recommendations
- Alert on JVM heap saturation and thread pool exhaustion on hosts running Apache CXF, Axis2, or other SOAP stacks.
- Track HTTP 5xx spikes on WS-* endpoints alongside memory metrics to identify parser-driven crashes.
- Forward application and container runtime telemetry to a centralized data lake for correlation across service instances.
How to Mitigate CVE-2026-66142
Immediate Actions Required
- Upgrade Apache Neethi to version 3.2.3 in all applications and container images.
- Rebuild and redeploy downstream frameworks (Apache CXF, Axis2, and similar) that bundle Neethi as a transitive dependency.
- Restrict exposure of WS-Policy consuming endpoints to authenticated or network-segmented clients where feasible.
Patch Information
The Apache Software Foundation released Apache Neethi 3.2.3, which enforces safe handling of policies without identifiers and prevents unbounded recursion during policy parsing. Users are recommended to upgrade to 3.2.3. Details are published in the Apache Mailing List Thread.
Workarounds
- Terminate SOAP traffic behind an XML gateway or Web Application Firewall (WAF) that limits XML nesting depth and payload size.
- Reject inbound WS-Policy documents lacking a valid policy Id attribute at the perimeter.
- Lower JVM thread and request timeouts to shorten the impact window if parser recursion begins.
# Configuration example: enforce a Maven dependency override to a fixed Neethi version
mvn dependency:tree | grep neethi
# In pom.xml, pin the fixed release:
# <dependency>
# <groupId>org.apache.neethi</groupId>
# <artifactId>neethi</artifactId>
# <version>3.2.3</version>
# </dependency>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
