Skip to content
Fencer Vulns
medium 6.5

CVE-2022-23437 json

Infinite loop within Apache XercesJ xml parser

published 2022-01-24 4 y ago modified 2026-10-08 31 d ago also GHSA-h65f-jvqw-m9fj , EUVD-2022-0613

cvss
6.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
11.6%
EPSS 11.6% chance of exploitation in 30 days, percentile 96%
public exploits
0
none known

Summary

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.

Patch / fix

  • maven xerces:xercesImpl 2.12.2
  • oracle communications_element_manager 9.0
  • oracle communications_session_report_manager 9.0
  • oracle communications_session_route_manager 9.0
  • oracle financial_services_analytical_applications_infrastructure 8.1.2.0
  • oracle global_lifecycle_management_nextgen_oui_framework 13.9.4.2.2
  • oracle global_lifecycle_management_opatch 12.2.0.1.30
  • libxerces2-java Debian 14, Debian 13, Debian 12 2.12.2-1

debian advisories DEBIAN-CVE-2022-23437

  • eap7-netty jboss enterprise application platform 7.4 4.1.72-4.Final_redhat_00001.1.el7eap
  • eap7-wildfly jboss enterprise application platform 7.4 7.4.5-3.GA_redhat_00001.1.el7eap
  • eap7-undertow jboss enterprise application platform 7.4 2.2.17-2.SP4_redhat_00001.1.el7eap
  • eap7-netty-all jboss enterprise application platform 7.4 4.1.72-4.Final_redhat_00001.1.el7eap
  • eap7-xerces-j2 jboss enterprise application platform 7.4 2.12.0-3.SP04_redhat_00001.1.el7eap
  • eap7-h2database jboss enterprise application platform 7.4 1.4.197-2.redhat_00004.1.el7eap
  • eap7-hal-console jboss enterprise application platform 7.4 3.3.12-1.Final_redhat_00001.1.el7eap
  • eap7-netty-codec jboss enterprise application platform 7.4 4.1.72-4.Final_redhat_00001.1.el7eap

red hat advisories RHSA-2022:4918RHSA-2022:4919

  • xerces-j2 SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES for SAP 12 SP3 +11 more 2.8.1-268.9.1
  • xerces-j2 SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +8 more 2.12.0-3.3.1
  • xerces-j2 SLES 11 SP4-LTSS, SLE Point of Sale 11 SP3 2.8.1-238.29.8.1
  • xerces-j2 SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +7 more 2.11.0-4.3.1

suse advisories SUSE-SU-2022:0542-1SUSE-SU-2022:0503-1SUSE-SU-2022:14889-1SUSE-SU-2022:0500-1

  • rubygem-nokogiri openSUSE Tumbleweed 1.18.9-1.4
  • rubygem-nokogiri openSUSE Tumbleweed 1.18.2-1.1
  • rubygem-nokogiri openSUSE Tumbleweed 1.15.5-1.5
  • xerces-j2 openSUSE Tumbleweed 2.12.2-1.1
  • rubygem-nokogiri openSUSE Tumbleweed 1.13.4-1.1
  • ruby3.2-rubygem-nokogiri openSUSE Tumbleweed 1.13.9-1.7
  • xerces-j2 openSUSE Leap 15.3 2.12.0-3.3.1
  • xerces-j2 openSUSE Leap 15.3 2.11.0-4.3.1

opensuse advisories openSUSE-SU-2026:10356-1openSUSE-SU-2025:14697-1openSUSE-SU-2024:14174-1openSUSE-SU-2024:11845-1openSUSE-SU-2024:11999-1openSUSE-SU-2024:13165-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-23437 updated cvss 6.5

xerces-j2: infinite loop when handling specially crafted XML document payloads

  • Red Hat Enterprise Linux 6 xerces-j2, xerces-j2-demo, xerces-j2-scripts, xerces-j2-javadoc-xni, xerces-j2-javadoc-apis, xerces-j2-javadoc-impl, +1 more Red Hat Enterprise Linux 7 xerces-j2, xerces-j2-demo, xerces-j2-javadoc
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 xerces-j2, xerces-j2-demo, xerces-j2-javadoc Red Hat Enterprise Linux 9 xerces-j2
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Enterprise Application Platform 6 xerces-j2-eap6 xerces-j2-eap6
    affected: no fix planned “Out of support scope”
  • Red Hat Software Collections rh-maven36-xerces-j2, rh-maven36-xerces-j2-demo, rh-maven36-xerces-j2-javadoc
    affected: no fix planned “Will not fix”
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-xerces-j2 2.12.0-3.SP04_redhat_00001.1.el7eap
    fixed: vendor fix RHSA-2022:4918
  • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-xerces-j2 2.12.0-3.SP04_redhat_00001.1.el8eap
    fixed: vendor fix RHSA-2022:4919
  • Red Hat JBoss Enterprise Application Platform xercesImpl 2.12.0.SP04-redhat-00001
    fixed: vendor fix RHSA-2022:4922
  • Red Hat RHPAM 7.13.1 async
    fixed: vendor fix RHSA-2022:6813
show 1 more
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-log4j 2.17.1-2.redhat_00002.1.el7eap, eap7-jberet 1.3.9-1.SP1_redhat_00001.1.el7eap, eap7-snakeyaml 1.29.0-1.redhat_00001.2.el7eap, eap7-wildfly 7.4.5-3.GA_redhat_00001.1.el7eap, eap7-h2database 1.4.197-2.redhat_00004.1.el7eap, eap7-netty 4.1.72-4.Final_redhat_00001.1.el7eap, +84 more Red Hat JBoss EAP 7.4 for RHEL 8 eap7-log4j 2.17.1-2.redhat_00002.1.el8eap, eap7-jberet 1.3.9-1.SP1_redhat_00001.1.el8eap, eap7-snakeyaml 1.29.0-1.redhat_00001.2.el8eap, eap7-wildfly 7.4.5-3.GA_redhat_00001.1.el8eap, eap7-h2database 1.4.197-2.redhat_00004.1.el8eap, eap7-netty 4.1.72-4.Final_redhat_00001.1.el8eap, +82 more Red Hat JBoss Enterprise Application Platform pom.xml, c3 0.6.0, c3 0.7.1, d3 5.9.2, ms 2.0.0, ms 2.1.2, +1482 more Red Hat JBoss Web Server 3 xerces-j2
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
31 d ago

Exploit prediction

11.62% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD 2.0 7.1 AV:N/AC:M/Au:N/C:N/I:N/A:C
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
maven xerces:xercesImpl
<2.12.2
2.12.2

Affected products

  • Apache Software Foundation Apache Xerces

Classification

Weakness
  • CWE-835 Loop with Unreachable Exit Condition
  • CWE-91 XML Injection

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.