VYPR
← All advisories
Critical severityNVD Advisory· Published Sep 11, 2022· Updated Aug 3, 2024

Apache Calcite: potential XEE attacks

CVE-2022-39135

Description

Apache Calcite 1.22.0 introduced the SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM and EXTRACT_VALUE do not restrict XML External Entity references in their configuration, making them vulnerable to a potential XML External Entity (XXE) attack. Therefore any client exposing these operators, typically by using Oracle dialect (the first three) or MySQL dialect (the last one), is affected by this vulnerability (the extent of it will depend on the user under which the application is running). From Apache Calcite 1.32.0 onwards, Document Type Declarations and XML External Entity resolution are disabled on the impacted operators.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Apache Calcite SQL operators in versions 1.22.0 to 1.31.0 are vulnerable to XXE attacks via Oracle/MySQL dialect XML functions, fixed in 1.32.0.

Vulnerability

Description

Apache Calcite versions 1.22.0 through 1.31.0 introduced SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM, and EXTRACT_VALUE that do not restrict XML External Entity (XXE) references in their configuration. This makes them vulnerable to XXE attacks when exposed to untrusted input [1]. The vulnerability affects any client that exposes these operators, typically by using the Oracle dialect (for the first three operators) or the MySQL dialect (for EXTRACT_VALUE) [1].

Exploitation

An attacker who can supply SQL queries to an application that uses the affected Apache Calcite operators can trigger an XXE attack. In deployments such as Apache Solr, the /sql handler in SolrCloud mode (versions 6.5 to 8.11.2 and 9.0) can be used to send malicious SQL queries that exploit this vulnerability, though such handlers are typically only exposed to internal analysts via JDBC tooling [2]. Successful exploitation requires the attacker to be able to submit crafted SQL statements containing malicious XML content [1].

Impact

An XXE attack can lead to disclosure of confidential data (e.g., local files), denial of service, server-side request forgery (SSRF), and port scanning from the affected server [1][2]. The actual impact depends on the privileges of the user under which the application runs [1].

Mitigation

The vulnerability is fixed in Apache Calcite version 1.32.0, which disables Document Type Declarations (DTDs) and XML External Entity resolution on the impacted operators [1]. Users of Apache Solr affected by this issue (versions 6.5 to 8.11.2 and 9.0) should upgrade to a patched Solr release that incorporates the fixed Calcite version [2]. No workarounds are documented; upgrading is the recommended action.

References
  1. NVD - CVE-2022-39135
  2. security - Apache Solr is vulnerable to CVE-2022-39135 via /sql handler

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.calcite:calcite-coreMaven
< 1.32.01.32.0

Affected products

136

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

4

News mentions

0

No linked articles in our index yet.