CVE-2022-23437: Infinite loop within Apache XercesJ xml parser
Vulnerability summary
CVE-2022-23437 is a high (CVSS 7.1) Loop with Unreachable Exit Condition vulnerability in apache software foundation apache xerces. EPSS estimates a 11.62% chance of exploitation in the next 30 days, higher than 96% of scored vulnerabilities.
Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 7 · Related 5Timeline
- 24-01-2022PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · MavenEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS trend
Probability
11.62%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
No change 0.00 pp
From 11.62% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Suse37 products
- xerces-j2&distro=HPE Helion OpenStack 8< 2.8.1-268.9.1
- xerces-j2&distro=SUSE Enterprise Storage 6< 2.11.0-4.3.1
- xerces-j2&distro=SUSE Enterprise Storage 7< 2.12.0-3.3.1
- xerces-j2&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS< 2.11.0-4.3.1
- xerces-j2&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 2.11.0-4.3.1
Oracle27 products
- agile_engineering_data_management6.2.1.0
- agile_product_lifecycle_management9.3.6
- banking_deposits_and_lines_of_credit_servicing2.7
- banking_party_management2.7.0
- communications_asap7.3
Opensuse2 products
- xerces-j2&distro=openSUSE Leap 15.3< 2.11.0-4.3.1 | < 2.12.0-3.3.1
- xerces-j2&distro=openSUSE Tumbleweed< 2.12.2-1.1
Apache1 product
- xerces-j≤ 2.12.1
Apache software foundation1 product
- apache xerces≥ Apache XercesJ, ≤ 2.12.1
Debian1 product
- libxerces2-java< 2.12.2-1
Netapp1 product
Ubuntu1 product
- libxerces2-javaAll versions (No fix recorded)
Xerces1 product
- xercesImpl< 2.12.2
9 vendors · 72 products
References
20 links- security.netapp.com/advisory/ntap-20221028-0005/Third Party Advisory
Show all 20 references
- lists.opensuse.org/archives/…Advisory
- lists.opensuse.org/archives/…Advisory
- github.com/jboss/xercesPACKAGE