7.5

CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets

Modified
AliasesSUSE-RU-2024:3971-1UBUNTU-CVE-2022-34169DEBIAN-CVE-2022-34169
Published 19-07-2022Last modified 27-05-2026

Vulnerability summary

CVE-2022-34169 is a high (CVSS 7.5) vulnerability in apache software foundation apache xalan-j. EPSS estimates a 81.76% chance of exploitation in the next 30 days, higher than 99.6% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 82% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
81.76%
0%100%
Critical · +0.72 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 50 · Related 26
DSA-5188-1DSA-5192-1MGASA-2022-0435OPENSUSE-SU-2024:12201-1OPENSUSE-SU-2024:12202-1OPENSUSE-SU-2024:12203-1

Timeline

  1. 19-07-2022
    PublishedVulnerability first disclosed.
  2. 27-05-2026
    Last modifiedVulnerability information updated.

Description

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

81.76%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

Increase +0.72 pp

From 81.04% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Suse72 products
  • apache-commons-lang3&distro=SUSE Enterprise Storage 7.1< 3.16.0-150200.3.9.2
  • apache-commons-lang3&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS< 3.16.0-150200.3.9.2
  • apache-commons-lang3&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS< 3.16.0-150200.3.9.2
  • apache-commons-lang3&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 3.16.0-150200.3.9.2
  • apache-commons-lang3&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 3.16.0-150200.3.9.2
Opensuse15 products
  • apache-commons-lang3&distro=openSUSE Leap 15.5< 3.16.0-150200.3.9.2
  • apache-commons-lang3&distro=openSUSE Leap 15.6< 3.16.0-150200.3.9.2
  • bcel&distro=openSUSE Leap 15.5< 6.10.0-150200.11.6.2
  • bcel&distro=openSUSE Leap 15.6< 6.10.0-150200.11.6.2
  • mojo-parent&distro=openSUSE Leap 15.5< 82-150200.3.10.1
Netapp8 products
Ubuntu8 products
  • libxalan2-javaAll versions (No fix recorded)
  • openjdk-13All versions (No fix recorded)
  • openjdk-16All versions (No fix recorded)
  • openjdk-17< 17.0.4+8-1~18.04 | < 17.0.4+8-1~20.04 | < 17.0.4+8-1~22.04
  • openjdk-18< 18.0.2+9-2~22.04
Alpine5 products
  • openjdk11< 11.0.17_p8-r0 | < 11.0.16_p8-r0
  • openjdk13< 13.0.12_p4-r0
  • openjdk15< 15.0.8_p4-r0
  • openjdk17< 17.0.4_p8-r0
  • openjdk8< 8.345.01-r0
Oracle4 products
  • graalvmEOL20.3.6 | 21.3.2 | 22.1.0
  • jdkEOL1.7.0:update343 | 1.8.0:update333 | 11.0.15.1 | 17.0.3.1 | 18.0.1.1
  • jreEOL1.7.0:update343 | 1.8.0:update333 | 11.0.15.1 | 17.0.3.1 | 18.0.1.1
  • openjdkEOL≥ 11, ≤ 11.0.15 | ≥ 13, ≤ 13.0.11 | ≥ 15, ≤ 15.0.7 | ≥ 17, ≤ 17.0.3 | 7 | 7:update1 | 7:update10 | 7:update101 | 7:update11 | 7:update111 | 7:update121 | 7:update13 | 7:update131 | 7:update141 | 7:update15 | 7:update151 | 7:update161 | 7:update17 | 7:update171 | 7:update181 | 7:update191 | 7:update2 | 7:update201 | 7:update21 | 7:update211 | 7:update221 | 7:update231 | 7:update241 | 7:update25 | 7:update251 | 7:update261 | 7:update271 | 7:update281 | 7:update291 | 7:update3 | 7:update301 | 7:update311 | 7:update321 | 7:update4 | 7:update40 | 7:update45 | 7:update5 | 7:update51 | 7:update55 | 7:update6 | 7:update60 | 7:update65 | 7:update67 | 7:update7 | 7:update72 | 7:update76 | 7:update80 | 7:update85 | 7:update9 | 7:update91 | 7:update95 | 7:update97 | 7:update99 | 8 | 8:milestone1 | 8:milestone2 | 8:milestone3 | 8:milestone4 | 8:milestone5 | 8:milestone6 | 8:milestone7 | 8:milestone8 | 8:milestone9 | 8:update101 | 8:update102 | 8:update11 | 8:update111 | 8:update112 | 8:update121 | 8:update131 | 8:update141 | 8:update151 | 8:update152 | 8:update161 | 8:update162 | 8:update171 | 8:update172 | 8:update181 | 8:update191 | 8:update192 | 8:update20 | 8:update201 | 8:update202 | 8:update211 | 8:update212 | 8:update221 | 8:update222 | 8:update231 | 8:update232 | 8:update241 | 8:update242 | 8:update25 | 8:update252 | 8:update262 | 8:update271 | 8:update281 | 8:update282 | 8:update291 | 8:update301 | 8:update302 | 8:update31 | 8:update312 | 8:update322 | 8:update332 | 8:update40 | 8:update45 | 8:update5 | 8:update51 | 8:update60 | 8:update65 | 8:update66 | 8:update71 | 8:update72 | 8:update73 | 8:update74 | 8:update77 | 8:update91 | 8:update92 | 18
Chainguard3 products
  • hadoop-fips-3.3.6All versions (No fix recorded)
  • hadoop-fips-3.4.2All versions (No fix recorded)
  • hadoop-fips-3.5All versions (No fix recorded)
Debian3 products
  • bcel< 6.5.0-1+deb11u1 | < 6.2-1+deb10u1 | < 6.5.0-2
  • openjdk-17< 17.0.4+8-1
  • debian_linuxEOL10.0 | 11.0
Apache1 product
Apache software foundation1 product
Azul1 product
  • zuluEOL6.47 | 7.54 | 8.62 | 11.56 | 13.48 | 15.40 | 17.34 | 18.30
Fedoraproject1 product
Xalan1 product
  • xalan< 2.7.3

13 vendors · 123 products

References

57 links
Show all 57 references