Back to CVE records
Medium 6.5Published Jan 24, 2022
CVE-2022-23437Infinite loop within Apache XercesJ xml parser
Updated under an hour ago ()
Does this affect you?
It affects Apache Software Foundation Apache Xerces and 29 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Start free and add your stack
Free account, 1 product
There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.
- CVSS
- 6.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- apache
- NVD analysis
- Modified
- Record last updated
- Oct 8, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Apache Software Foundation Apache Xerces apache_software_foundation:apache_xerces (from the name) | from Apache XercesJ through 2.12.1 | CNA record |
apache xerces-j apache:xerces-j | through 2.12.1 | NVD |
oracle agile_engineering_data_management oracle:agile_engineering_data_management | 6.2.1.0 | NVD |
oracle agile_product_lifecycle_management oracle:agile_product_lifecycle_management | 9.3.6 | NVD |
oracle banking_deposits_and_lines_of_credit_servicing oracle:banking_deposits_and_lines_of_credit_servicing | 2.7 | NVD |
oracle banking_party_management oracle:banking_party_management | 2.7.0 | NVD |
oracle communications_asap oracle:communications_asap | 7.3 | NVD |
oracle communications_element_manager oracle:communications_element_manager | before 9.0 | NVD |
oracle communications_session_report_manager oracle:communications_session_report_manager | before 9.0 | NVD |
oracle communications_session_route_manager oracle:communications_session_route_manager | before 9.0 | NVD |
oracle financial_services_analytical_applications_infrastructure oracle:financial_services_analytical_applications_infrastructure | from 8.0.6.0.0 through 8.0.9.0; from 8.1.0.0 before 8.1.2.0 | NVD |
oracle financial_services_behavior_detection_platform oracle:financial_services_behavior_detection_platform | from 8.0.6.0.0 through 8.0.8.0; 8.1.1.0; 8.1.1.1; 8.1.2.0 | NVD |
oracle financial_services_crime_and_compliance_management_studio oracle:financial_services_crime_and_compliance_management_studio | 8.0.8.2.0; 8.0.8.3.0 | NVD |
oracle financial_services_enterprise_case_management oracle:financial_services_enterprise_case_management | 8.0.7.1; 8.0.7.2.0; 8.0.8.0; 8.0.8.1; 8.1.1.0; 8.1.1.1 | NVD |
oracle flexcube_universal_banking oracle:flexcube_universal_banking | 12.4.0 | NVD |
oracle global_lifecycle_management_nextgen_oui_framework oracle:global_lifecycle_management_nextgen_oui_framework | before 13.9.4.2.2; 13.9.4.2.2 | NVD |
oracle global_lifecycle_management_opatch oracle:global_lifecycle_management_opatch | before 12.2.0.1.30 | NVD |
oracle health_sciences_information_manager oracle:health_sciences_information_manager | from 3.0.1 through 3.0.5; 3.0.0.1 | NVD |
oracle ilearning oracle:ilearning | 6.2; 6.3 | NVD |
oracle peoplesoft_enterprise_peopletools oracle:peoplesoft_enterprise_peopletools | 8.58; 8.59 | NVD |
oracle primavera_gateway oracle:primavera_gateway | from 17.7 through 17.12.11; from 18.8.0 through 18.8.14; from 19.12.0 through 19.12.13; from 20.12.0 through 20.12.8 | NVD |
oracle product_lifecycle_analytics oracle:product_lifecycle_analytics | 3.6.1 | NVD |
oracle retail_bulk_data_integration oracle:retail_bulk_data_integration | 16.0.3.0 | NVD |
oracle retail_extract_transform_and_load oracle:retail_extract_transform_and_load | 13.2.8 | NVD |
oracle retail_financial_integration oracle:retail_financial_integration | 14.1.3.2; 15.0.3.1; 16.0.3; 19.0.1 | NVD |
oracle retail_integration_bus oracle:retail_integration_bus | 14.1.3.2; 15.0.3.1; 16.0.3; 19.0.1 | NVD |
oracle retail_merchandising_system oracle:retail_merchandising_system | 16.0.3; 19.0.1 | NVD |
oracle retail_service_backbone oracle:retail_service_backbone | 14.1.3.2; 15.0.3.1; 16.0.3; 19.0.1 | NVD |
oracle weblogic_server oracle:weblogic_server | 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0 | NVD |
netapp active_iq_unified_manager netapp:active_iq_unified_manager | all versions | NVD |
References
- https://lists.apache.org/thread/6pjwm10bb69kq955fzr1n0nflnjd27dl
- http://www.openwall.com/lists/oss-security/2022/01/24/3mailing-list
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://security.netapp.com/advisory/ntap-20221028-0005/
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.