CVE-2026-42402 describes a vulnerability in Apache Neethi where the normalization of WS-Policy documents can cause exponential Cartesian cross-product expansion of policy alternatives. This leads to unbounded memory allocation and JVM heap exhaustion, resulting in denial of service. The vulnerability is due to uncontrolled resource consumption (CWE-400). The Apache Software Foundation recommends upgrading to Apache Neethi 3.2.2, which limits the maximum number of normalized policy alternatives to prevent this issue.

The vulnerability allows an attacker to cause a denial of service by exhausting the JVM heap memory through specially crafted WS-Policy documents that trigger excessive policy alternative generation. This results in application or service downtime due to memory exhaustion. There is no impact on confidentiality or integrity reported.

Users should upgrade to Apache Neethi version 3.2.2 or later, which includes a fix that limits the maximum number of normalized policy alternatives during the normalization process. Patch status is not explicitly confirmed in the advisory fields, but the vendor recommends upgrading to 3.2.2 as the remediation. No other mitigations are specified.