CVE-2026-66143 Overview
CVE-2026-66143 is a denial of service vulnerability in Apache Neethi, a framework for working with WS-Policy documents. Attackers can bypass the maximum number of normalized policy alternatives introduced in Apache Neethi 3.2.2 by submitting crafted policies. The bypass triggers excessive resource consumption during policy normalization. Apache has released version 3.2.3 to address the issue. The weakness is tracked as [CWE-400] Uncontrolled Resource Consumption.
Critical Impact
Remote unauthenticated attackers can exhaust CPU and memory on services that process untrusted WS-Policy documents, causing denial of service.
Affected Products
- Apache Neethi 3.2.2
- Applications and services embedding Apache Neethi for WS-Policy processing
- Downstream Apache projects that depend on Neethi for policy handling
Discovery Timeline
- 2026-07-24 - CVE-2026-66143 published to NVD
- 2026-07-27 - Last updated in NVD database
Technical Details for CVE-2026-66143
Vulnerability Analysis
Apache Neethi normalizes WS-Policy documents into a canonical form that enumerates policy alternatives. Version 3.2.2 introduced a cap on the maximum number of normalized alternatives to prevent combinatorial expansion. CVE-2026-66143 shows that specific policy structures can bypass this cap. When Neethi processes such a policy, the normalization step consumes CPU and memory beyond the intended limit. This turns policy parsing into a denial of service primitive against any service that accepts external policy documents.
Root Cause
The cap on normalized alternatives does not account for every construct that expands during normalization. Crafted nesting of policy operators produces alternatives that grow past the intended threshold. The counting logic evaluates state at a point that lets certain expansions escape enforcement. This is a classic uncontrolled resource consumption flaw classified under [CWE-400].
Attack Vector
The attack requires network access to an endpoint that parses WS-Policy documents using Apache Neethi. No authentication or user interaction is required. An attacker submits a crafted policy payload, typically inside a SOAP request or a WSDL fetched by the target. Neethi expands the policy during normalization and consumes disproportionate resources. Repeated submissions amplify the impact and can render the service unresponsive.
No verified public exploit code is available. See the Apache Mailing List Thread and the OpenWall OSS Security Post for the technical description from the maintainers.
Detection Methods for CVE-2026-66143
Indicators of Compromise
- Sustained high CPU or heap usage in Java processes hosting Apache Neethi during SOAP or WS-Policy request handling
- Thread dumps showing extended time inside org.apache.neethi normalization classes such as Policy.normalize
- Repeated inbound SOAP requests containing large or deeply nested wsp:Policy, wsp:ExactlyOne, or wsp:All elements from the same source
Detection Strategies
- Inspect application logs for OutOfMemoryError, long garbage collection pauses, or request timeouts correlated with WS-Policy processing
- Add JVM instrumentation or APM traces on Neethi normalization methods to flag calls that exceed baseline duration or allocation
- Alert on anomalous request sizes or nesting depth for endpoints that accept WS-Policy, WSDL, or SOAP payloads
Monitoring Recommendations
- Track the version of the neethi artifact deployed with every Java service using software composition analysis
- Monitor request rate and payload size distributions for SOAP and policy endpoints and alert on outliers
- Correlate service degradation events with recent policy parsing activity to detect exploitation attempts early
How to Mitigate CVE-2026-66143
Immediate Actions Required
- Upgrade Apache Neethi to version 3.2.3 in all applications, including transitive dependencies
- Inventory Java services that expose WS-Policy, WSDL, or SOAP endpoints and confirm the Neethi version each ships
- Restrict exposure of policy-processing endpoints to trusted networks until patched
Patch Information
Apache has released Apache Neethi 3.2.3, which corrects the enforcement of the maximum number of normalized policy alternatives. Users are recommended to upgrade to 3.2.3. Rebuild and redeploy any applications that bundle Neethi as a dependency, and update Maven or Gradle build files accordingly. Refer to the Apache Mailing List Thread for the official announcement.
Workarounds
- Place a reverse proxy or WAF in front of SOAP endpoints to reject oversized or deeply nested wsp:Policy documents
- Enforce request size and parse timeouts on services that accept WS-Policy input
- Limit policy parsing to authenticated clients where the application design permits
# Update Apache Neethi to the fixed version in Maven
mvn versions:use-dep-version -Dincludes=org.apache.neethi:neethi -DdepVersion=3.2.3 -DforceVersion=true
mvn dependency:tree | grep neethi
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
