CVE-2026-66144: Apache Neethi DOS Vulnerability

CVE-2026-66144 Overview

CVE-2026-66144 is a denial-of-service vulnerability in Apache Neethi, a framework for parsing and processing WS-Policy assertions. Although remote policy references are not retrieved during standard policy normalization, applications that manually retrieve them through the API can be forced to load excessively large policy documents. An attacker who controls or influences a referenced remote policy can trigger resource exhaustion by returning an oversized payload. The issue is tracked under [CWE-400: Uncontrolled Resource Consumption]. Apache has released version 3.2.3, which imposes a default maximum size on data read from remote policy references.

Critical Impact
A remote, unauthenticated attacker can exhaust memory or processing resources on applications using Apache Neethi's API to fetch remote policy references, causing service disruption.

Affected Products

Apache Neethi versions prior to 3.2.3
Applications embedding Apache Neethi for WS-Policy processing
Apache CXF and other frameworks that depend on Neethi for policy handling

Discovery Timeline

2026-07-24 - CVE-2026-66144 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-66144

Vulnerability Analysis

Apache Neethi processes WS-Policy documents that can include references to remote policies via PolicyReference elements. During normal policy normalization, Neethi intentionally does not dereference remote URIs. However, the library exposes API methods that allow applications to manually retrieve and merge those remote references. Before version 3.2.3, this retrieval path had no upper bound on the size of the fetched document. An attacker who controls the remote endpoint referenced by a PolicyReference can respond with an arbitrarily large payload. The receiving application then attempts to buffer and parse the entire document, consuming excessive memory and CPU. The vulnerability affects availability only, with confidentiality and integrity unchanged.

Root Cause

The root cause is a missing size limit on the input stream when Neethi's API retrieves data from a remote policy reference URI. Without a maximum byte threshold, the library trusts the remote server to return a reasonably sized document. This constitutes uncontrolled resource consumption as classified under CWE-400.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker either hosts a malicious policy endpoint or compromises a server referenced by a legitimate WS-Policy document. When the target application calls the Neethi API to resolve remote references, the attacker's server returns a very large response. This causes the JVM to allocate substantial memory, potentially resulting in OutOfMemoryError conditions and process instability. Technical details are available in the Apache Mailing List Discussion and the OpenWall OSS Security Update.

Detection Methods for CVE-2026-66144

Indicators of Compromise

Unexpected outbound HTTP or HTTPS requests from Java application servers to unfamiliar hosts referenced in WS-Policy documents
OutOfMemoryError or sustained heap growth in application logs correlated with WS-Policy processing
Long-running or hung threads inside org.apache.neethi package stack frames
Sudden spikes in inbound network traffic tied to SOAP or WS-* endpoints

Detection Strategies

Inventory applications that include the neethi JAR and identify any code paths that invoke remote policy reference resolution APIs
Instrument JVM heap and garbage collection metrics on services that process WS-Policy documents
Alert on HTTP responses larger than expected thresholds returning to Java processes hosting SOAP endpoints

Monitoring Recommendations

Track dependency versions of apache:neethi in software bills of materials and flag versions below 3.2.3
Monitor egress traffic from application servers to detect policy reference fetches to unexpected external hosts
Correlate application crashes and restarts with WS-Policy request patterns in SIEM data

How to Mitigate CVE-2026-66144

Immediate Actions Required

Upgrade Apache Neethi to version 3.2.3 or later across all dependent applications
Audit application code for calls that manually retrieve remote policy references via the Neethi API
Restrict outbound network access from application servers to only trusted policy endpoints
Review WS-Policy documents in use and remove unnecessary PolicyReference elements pointing to external URIs

Patch Information

Apache has released Apache Neethi 3.2.3, which imposes a default maximum size on data read from remote policy references. Users of downstream frameworks such as Apache CXF should update to releases that bundle the fixed Neethi version. Consult the Apache Mailing List Discussion for the official announcement.

Workarounds

Disable manual retrieval of remote policy references in application code until upgrading is possible
Deploy an outbound proxy or firewall rule that blocks or size-limits responses from external policy reference endpoints
Configure JVM heap limits and enforce request timeouts to reduce the blast radius of oversized policy responses
Validate and whitelist all remote policy reference URIs before allowing resolution

bash

# Configuration example: verify installed Neethi version and update via Maven
mvn dependency:tree | grep neethi

# Update dependency in pom.xml
# <dependency>
#   <groupId>org.apache.neethi</groupId>
#   <artifactId>neethi</artifactId>
#   <version>3.2.3</version>
# </dependency>

mvn clean install -U