CVE-2022-23437
Infinite loop within Apache XercesJ xml parser
- State
- Published
- Severity
- Not scored
- Published
- Jan 24, 2022
- Updated
- Oct 8, 2026
- Reserved
- Jan 19, 2022
Description
There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Apache XercesApache Software Foundation |
|
References
- https://lists.apache.org/thread/6pjwm10bb69kq955fzr1n0nflnjd27dl
- [oss-security] 20220124 CVE-2022-23437: Infinite loop within Apache XercesJ xml parsermailing-list
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://security.netapp.com/advisory/ntap-20221028-0005/
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.