Apache Neethi versions prior to 3.2.3 are vulnerable to a denial of service condition due to uncontrolled resource consumption (CWE-400) when large remote policy references are manually retrieved via the API. Although remote policy references are not fetched during policy normalization, manual retrieval can cause excessive resource use. The vulnerability is addressed in version 3.2.3 by limiting the maximum size of data read from remote policy references.

An attacker can cause a denial of service by forcing the application to process a very large remote policy reference, leading to resource exhaustion. This can degrade or disrupt service availability for users relying on Apache Neethi versions before 3.2.3.

Users should upgrade to Apache Neethi version 3.2.3 or later, which includes a fix that imposes a default maximum size on data read from remote policy references, preventing uncontrolled resource consumption. No other mitigation is specified.