Apache Neethi versions before 3.2.3 are vulnerable to a denial of service condition due to uncontrolled resource consumption (CWE-400). While remote policy references are not automatically retrieved during policy normalization, manual retrieval through the API of a very large policy can exhaust resources and cause service disruption. The vulnerability has a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating network attack vector, low complexity, no privileges or user interaction required, and impact limited to availability. The fix in version 3.2.3 introduces a default maximum size limit on data read from remote policy references to mitigate this risk.

Exploitation of this vulnerability can cause denial of service by exhausting system resources when processing large remote policy references manually retrieved via the API. There is no confidentiality or integrity impact reported. The service availability is impacted, potentially causing downtime or degraded performance.

Users should upgrade Apache Neethi to version 3.2.3 or later, which includes a fix that imposes a default maximum size on data read from remote policy references. No other mitigation or workaround is indicated. Patch status is not explicitly stated as 'official-fix' or 'patchAvailable' but the vendor recommends upgrading to 3.2.3 to address the issue.