Threats tagged 'ghsa-g36m-9g3m-2vmp'

Apache Neethi versions prior to 3.2.2 are vulnerable to a denial of service (DoS) attack caused by algorithmic complexity during policy normalization. Maliciously crafted WS-Policy documents can trigger an exponential expansion of policy alternatives, leading to unbounded memory allocation and JVM heap exhaustion. This vulnerability is addressed in version 3.2.2, which limits the maximum number of normalized policy alternatives.