Medium severity6.5NVD Advisory· Published Jan 24, 2022· Updated Jun 17, 2026

CVE-2022-23437

Description

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
xerces:xercesImplMaven	< 2.12.2	2.12.2

Affected products

osv-coords42 versions
pkg:rpm/opensuse/ruby3.2-rubygem-nokogiri&distro=openSUSE%20Tumbleweed pkg:maven/xerces/xercesImpl pkg:rpm/suse/xerces-j2&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOS pkg:rpm/suse/xerces-j2&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSS pkg:rpm/suse/xerces-j2&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-BCL pkg:rpm/suse/xerces-j2&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSS pkg:rpm/suse/xerces-j2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015 pkg:rpm/suse/xerces-j2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP3 pkg:rpm/suse/xerces-j2&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSS pkg:rpm/suse/xerces-j2&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2015%20SP2 pkg:rpm/suse/xerces-j2&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-BCL pkg:rpm/suse/xerces-j2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2 pkg:rpm/suse/xerces-j2&distro=SUSE%20Manager%20Proxy%204.1 pkg:rpm/suse/xerces-j2&distro=SUSE%20Manager%20Retail%20Branch%20Server%204.1 pkg:rpm/suse/xerces-j2&distro=SUSE%20Manager%20Server%204.1 pkg:rpm/suse/xerces-j2&distro=SUSE%20Enterprise%20Storage%207 pkg:rpm/suse/xerces-j2&distro=HPE%20Helion%20OpenStack%208 pkg:rpm/suse/xerces-j2&distro=SUSE%20OpenStack%20Cloud%208 pkg:rpm/suse/xerces-j2&distro=SUSE%20OpenStack%20Cloud%209 pkg:rpm/suse/xerces-j2&distro=SUSE%20OpenStack%20Cloud%20Crowbar%208 pkg:rpm/suse/xerces-j2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3 pkg:rpm/suse/xerces-j2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4 pkg:rpm/suse/xerces-j2&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-LTSS pkg:rpm/suse/xerces-j2&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-BCL pkg:rpm/suse/xerces-j2&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5 pkg:rpm/suse/xerces-j2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5 pkg:rpm/suse/xerces-j2&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-ESPOS pkg:rpm/suse/xerces-j2&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSS pkg:rpm/suse/xerces-j2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1 pkg:rpm/suse/xerces-j2&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSS pkg:rpm/suse/xerces-j2&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5 pkg:rpm/opensuse/xerces-j2&distro=openSUSE%20Leap%2015.3 pkg:rpm/opensuse/rubygem-nokogiri&distro=openSUSE%20Tumbleweed pkg:rpm/suse/xerces-j2&distro=SUSE%20Linux%20Enterprise%20Point%20of%20Sale%2011%20SP3 pkg:rpm/suse/xerces-j2&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSS pkg:rpm/suse/xerces-j2&distro=SUSE%20Enterprise%20Storage%206 pkg:rpm/suse/xerces-j2&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSS pkg:rpm/suse/xerces-j2&distro=SUSE%20OpenStack%20Cloud%20Crowbar%209 pkg:rpm/suse/xerces-j2&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-ESPOS pkg:rpm/suse/xerces-j2&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCL pkg:rpm/suse/xerces-j2&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4-LTSS pkg:rpm/opensuse/xerces-j2&distro=openSUSE%20Tumbleweed
< 1.13.9-1.7+ 41 more
- (no CPE)range: < 1.13.9-1.7
- (no CPE)range: < 2.12.2
- (no CPE)range: < 2.11.0-4.3.1
- (no CPE)range: < 2.11.0-4.3.1
- (no CPE)range: < 2.11.0-4.3.1
- (no CPE)range: < 2.11.0-4.3.1
- (no CPE)range: < 2.11.0-4.3.1
- (no CPE)range: < 2.12.0-3.3.1
- (no CPE)range: < 2.12.0-3.3.1
- (no CPE)range: < 2.12.0-3.3.1
- (no CPE)range: < 2.12.0-3.3.1
- (no CPE)range: < 2.12.0-3.3.1
- (no CPE)range: < 2.12.0-3.3.1
- (no CPE)range: < 2.12.0-3.3.1
- (no CPE)range: < 2.12.0-3.3.1
- (no CPE)range: < 2.12.0-3.3.1
- (no CPE)range: < 2.8.1-268.9.1
- (no CPE)range: < 2.8.1-268.9.1
- (no CPE)range: < 2.8.1-268.9.1
- (no CPE)range: < 2.8.1-268.9.1
- (no CPE)range: < 2.8.1-268.9.1
- (no CPE)range: < 2.8.1-268.9.1
- (no CPE)range: < 2.8.1-268.9.1
- (no CPE)range: < 2.8.1-268.9.1
- (no CPE)range: < 2.8.1-268.9.1
- (no CPE)range: < 2.8.1-268.9.1
- (no CPE)range: < 2.11.0-4.3.1
- (no CPE)range: < 2.11.0-4.3.1
- (no CPE)range: < 2.11.0-4.3.1
- (no CPE)range: < 2.12.0-3.3.1
- (no CPE)range: < 2.8.1-268.9.1
- (no CPE)range: < 2.11.0-4.3.1
- (no CPE)range: < 1.13.4-1.1
- (no CPE)range: < 2.8.1-238.29.8.1
- (no CPE)range: < 2.11.0-4.3.1
- (no CPE)range: < 2.11.0-4.3.1
- (no CPE)range: < 2.8.1-238.29.8.1
- (no CPE)range: < 2.8.1-268.9.1
- (no CPE)range: < 2.12.0-3.3.1
- (no CPE)range: < 2.8.1-268.9.1
- (no CPE)range: < 2.8.1-268.9.1
- (no CPE)range: < 2.12.2-1.1
Apache Software Foundation/Apache Xercesv5
Range: Apache XercesJ
Apache/Xerces J
cpe:2.3:a:apache:xerces-j:*:*:*:*:*:*:*:*
Range: <=2.12.1
Oracle Corporation/Agile Engineering Data Management
cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:*
Oracle Corporation/Agile Plm
cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*
Oracle Corporation/Banking Deposits And Lines Of Credit Servicing
cpe:2.3:a:oracle:banking_deposits_and_lines_of_credit_servicing:2.7:*:*:*:*:*:*:*
Oracle Corporation/Banking Party Management
cpe:2.3:a:oracle:banking_party_management:2.7.0:*:*:*:*:*:*:*
Oracle Corporation/Communications Asap
cpe:2.3:a:oracle:communications_asap:7.3:*:*:*:*:*:*:*
Oracle Corporation/Communications Element Manager
cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:*
Range: <9.0
Oracle Corporation/Communications Session Report Manager
cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:*
Range: <9.0
Oracle Corporation/Communications Session Route Manager
cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:*
Range: <9.0
Oracle Corporation/Financial Services Analytical Applications Infrastructure
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*
Range: >=8.0.6.0.0,<=8.0.9.0
Oracle Corporation/Financial Services Behavior Detection Platform4 versions
cpe:2.3:a:oracle:financial_services_behavior_detection_platform:*:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:oracle:financial_services_behavior_detection_platform:*:*:*:*:*:*:*:*range: >=8.0.6.0.0,<=8.0.8.0
- cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.0:*:*:*:*:*:*:*
Oracle Corporation/Financial Services Crime And Compliance Management Studio2 versions
cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:*
Oracle Corporation/Financial Services Enterprise Case Management6 versions
cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.7.1:*:*:*:*:*:*:*+ 5 more
- cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.7.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.7.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.8.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.8.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.1:*:*:*:*:*:*:*
Oracle Corporation/Flexcube Universal Banking
cpe:2.3:a:oracle:flexcube_universal_banking:12.4.0:*:*:*:*:*:*:*
Oracle Corporation/Global Lifecycle Management Nextgen Oui Framework2 versions
cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:*:*:*:*:*:*:*:*range: <13.9.4.2.2
- cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:13.9.4.2.2:*:*:*:*:*:*:*
Oracle Corporation/Global Lifecycle Management Opatch
cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:*
Range: <12.2.0.1.30
Oracle Corporation/Health Sciences Information Manager2 versions
cpe:2.3:a:oracle:health_sciences_information_manager:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:health_sciences_information_manager:*:*:*:*:*:*:*:*range: >=3.0.1,<=3.0.5
- cpe:2.3:a:oracle:health_sciences_information_manager:3.0.0.1:*:*:*:*:*:*:*
Oracle Corporation/Ilearning2 versions
cpe:2.3:a:oracle:ilearning:6.2:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:ilearning:6.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:ilearning:6.3:*:*:*:*:*:*:*
Oracle Corporation/Peoplesoft Enterprise Peopletools2 versions
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*
Oracle Corporation/Primavera Gateway
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*
Range: >=17.7,<=17.12.11
Oracle Corporation/Product Lifecycle Analytics
cpe:2.3:a:oracle:product_lifecycle_analytics:3.6.1:*:*:*:*:*:*:*
Oracle Corporation/Retail Bulk Data Integration
cpe:2.3:a:oracle:retail_bulk_data_integration:16.0.3.0:*:*:*:*:*:*:*
Oracle Corporation/Retail Extract Transform And Load
cpe:2.3:a:oracle:retail_extract_transform_and_load:13.2.8:*:*:*:*:*:*:*
Oracle Corporation/Retail Financial Integration4 versions
cpe:2.3:a:oracle:retail_financial_integration:14.1.3.2:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:oracle:retail_financial_integration:14.1.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_financial_integration:15.0.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_financial_integration:16.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_financial_integration:19.0.1:*:*:*:*:*:*:*
Oracle Corporation/Retail Integration Bus4 versions
cpe:2.3:a:oracle:retail_integration_bus:14.1.3.2:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:oracle:retail_integration_bus:14.1.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_integration_bus:15.0.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_integration_bus:16.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_integration_bus:19.0.1:*:*:*:*:*:*:*
Oracle Corporation/Retail Merchandising System2 versions
cpe:2.3:a:oracle:retail_merchandising_system:16.0.3:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:retail_merchandising_system:16.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_merchandising_system:19.0.1:*:*:*:*:*:*:*
Oracle Corporation/Retail Service Backbone4 versions
cpe:2.3:a:oracle:retail_service_backbone:14.1.3.2:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:oracle:retail_service_backbone:14.1.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_service_backbone:15.0.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_service_backbone:16.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_service_backbone:19.0.1:*:*:*:*:*:*:*
Oracle Corporation/Weblogic Server3 versions
cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*
NetApp/Active Iq Unified Manager
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*

Patches

Vulnerability mechanics

References

www.oracle.com/security-alerts/cpuapr2022.htmlnvdPatchThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpujul2022.htmlnvdPatchThird Party AdvisoryWEB
www.openwall.com/lists/oss-security/2022/01/24/3nvdMailing ListThird Party AdvisoryWEB
github.com/advisories/GHSA-h65f-jvqw-m9fjghsaADVISORY
lists.apache.org/thread/6pjwm10bb69kq955fzr1n0nflnjd27dlnvdMailing ListVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2022-23437ghsaADVISORY
security.netapp.com/advisory/ntap-20221028-0005/nvdThird Party Advisory
security.netapp.com/advisory/ntap-20221028-0005ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.004
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000