VYPR
← All advisories
Moderate severityNVD Advisory· Published Jan 24, 2022· Updated Aug 3, 2024

Infinite loop within Apache XercesJ xml parser

CVE-2022-23437

Description

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Apache XercesJ XML parser versions ≤2.12.1 are vulnerable to an infinite loop via specially crafted XML, causing prolonged resource consumption.

Vulnerability

Apache Xerces Java (XercesJ) XML parser versions 2.12.1 and earlier contain a vulnerability that causes an infinite loop when processing specially crafted XML document payloads [1]. The bug resides in the parser's handling of malformed or deeply nested XML structures, leading to uncontrolled iteration without termination [3].

Exploitation

An attacker can exploit this vulnerability by sending a crafted XML document to any application that uses the vulnerable XercesJ parser to parse untrusted XML input [1]. No authentication or special network position is required; the attack is remote and can be delivered via HTTP, file upload, or any other mechanism that feeds XML to the parser [3]. The parser enters an infinite loop upon encountering the malicious payload, consuming CPU and memory resources indefinitely.

Impact

Successful exploitation results in a denial-of-service (DoS) condition. The infinite loop causes the parser to hang, consuming system resources (CPU and memory) for a prolonged duration, potentially leading to application unresponsiveness or crash [1][3]. The impact is limited to availability; no data confidentiality or integrity is compromised.

Mitigation

Apache released version 2.12.2 to fix this vulnerability [3]. Users should upgrade to 2.12.2 or later. If upgrading is not immediately possible, consider using an alternative XML parser or applying input validation to reject malformed XML documents. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date.

References
  1. NVD - CVE-2022-23437
  2. security - CVE-2022-23437: Infinite loop within Apache XercesJ xml parser

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
xerces:xercesImplMaven
< 2.12.22.12.2

Affected products

43

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

8

News mentions

0

No linked articles in our index yet.