VYPR
← All advisories
High severityNVD Advisory· Published Jul 19, 2022· Updated Feb 13, 2025

Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets

CVE-2022-34169

Description

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Apache Xalan Java XSLT library suffers from an integer truncation vulnerability that allows arbitrary code execution via malicious XSLT stylesheets.

Vulnerability

Description

Apache Xalan Java's XSLT library contains an integer truncation issue in its internal XSLTC compiler when processing malicious XSLT stylesheets. This flaw can corrupt Java class files generated by the compiler, leading to arbitrary Java bytecode execution [1].

Exploitation

An attacker can exploit this vulnerability by supplying a specially crafted XSLT stylesheet to an application that uses Xalan to perform XSL transformations. No authentication is required, and the attack can be carried out over the network if the application processes untrusted stylesheets. The vulnerability lies in the XSLTC compiler's handling of integer values during bytecode generation, as demonstrated by the commit that fixes the truncation [4].

Impact

Successful exploitation allows an attacker to execute arbitrary Java bytecode in the context of the application, potentially leading to full system compromise, data theft, or further lateral movement within the network.

Mitigation

Users are advised to upgrade to Apache Xalan Java version 2.7.3 or later, which contains the fix for this vulnerability [3]. Note that Java runtimes (such as OpenJDK) include repackaged copies of Xalan, so updating the JDK/JRE may also be necessary.

References
  1. NVD - CVE-2022-34169
  2. ASF: The Apache Xalan Project
  3. xalanj commit : integer truncation fix, for xsltc · apache/xalan-java@da3e0d0

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
xalan:xalanMaven
< 2.7.32.7.3

Affected products

259

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

46

News mentions

0

No linked articles in our index yet.