Description
Apache Neethi does not properly detect circular references in policy definitions. When a WS-Policy document contains circular policy references (where Policy A references Policy B which references Policy A), the policy normalization process can enter an infinite loop or cause excessive recursion, leading to a stack overflow or application hang. An attacker can craft malicious policy documents with circular references to cause a Denial of Service condition
Users are recommended to upgrade to version 3.2.2, which fixes this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Neethi | < 3.2.2 | 3.2.2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | wildfly-openjdk-17 +1 | 39.0.1-r7 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.neethi:neethi | < 3.2.2 | 3.2.2 | GHSA-2hfh-9h53-qc24 |
Advisories 3
- WID-SEC-2026-3043 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 17, 2026
- WID-SEC-2026-2050 IBM WebSphere Application Server und Application Server Liberty: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 14, 2026
- WID-SEC-2026-2438 Oracle Commerce: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 21, 2026
References
- https://lists.apache.org/thread/zm6t8skkkskjwk1881l4m4n0l7dqclzo vendor-advisory