Log in Start free

Vulnerability · Published Jan 24, 2022 · Assigned by apache

CVE-2022-23437Infinite loop within Apache XercesJ xml parser

Medium 6.5

In plain English

A medium-severity security flaw in Apache Xerces from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 11.6% (higher than 96% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)11.6%top 3.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libxerces2-java2.12.2-1DEBIAN-CVE-2022-23437
Debian:13libxerces2-java2.12.2-1DEBIAN-CVE-2022-23437
Debian:14libxerces2-java2.12.2-1DEBIAN-CVE-2022-23437
Mavenxerces:xercesImpl2.12.2GHSA-h65f-jvqw-m9fj
Ubuntu:22.04:LTSlibxerces2-javano fix listedUBUNTU-CVE-2022-23437
Ubuntu:24.04:LTSlibxerces2-javano fix listedUBUNTU-CVE-2022-23437
Ubuntu:25.10libxerces2-javano fix listedUBUNTU-CVE-2022-23437
Ubuntu:26.04:LTSlibxerces2-javano fix listedUBUNTU-CVE-2022-23437
Ubuntu:26.10libxerces2-javano fix listedUBUNTU-CVE-2022-23437

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache Xerces Apache XercesJ – through 2.12.1

References