CVE-2022-23437: Infinite loop within Apache XercesJ xml parser

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 11.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-01-24 · updated 2026-10-08
Weakness: CWE-835

Description

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.

Affected products

Apache Xerces-J: through 2.12.1
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
Oracle Corporation Oracle Agile Engineering Data Management: 6.2.1.0
Oracle Corporation Oracle Agile PLM: 9.3.6
Oracle Banking Deposits And Lines Of Credit Servicing: 2.7
Oracle Banking Party Management: 2.7.0
Oracle Communications Asap: 7.3
Oracle Communications Element Manager: before 9.0 — fixed in 9.0
Oracle Communications Session Report Manager: before 9.0 — fixed in 9.0
Oracle Communications Session Route Manager: before 9.0 — fixed in 9.0
Oracle Corporation Financial Services Analytical Applications Infrastructure: from 8.0.6.0.0 through 8.0.9.0; from 8.1.0.0 before 8.1.2.0 — fixed in 8.1.2.0
Oracle Corporation Financial Services Behavior Detection Platform: from 8.0.6.0.0 through 8.0.8.0; 8.1.1.0, 8.1.1.1, 8.1.2.0
Oracle Financial Services Crime And Compliance Management Studio: 8.0.8.2.0, 8.0.8.3.0
Oracle Corporation Oracle Financial Services Enterprise Case Management: 8.0.7.1, 8.0.7.2.0, 8.0.8.0, 8.0.8.1, 8.1.1.0, 8.1.1.1
Oracle Corporation FLEXCUBE Universal Banking: 12.4.0
Oracle Corporation Global Lifecycle Management NextGen OUI Framework: before 13.9.4.2.2; 13.9.4.2.2 — fixed in 13.9.4.2.2
Oracle Global Lifecycle Management Opatch: before 12.2.0.1.30 — fixed in 12.2.0.1.30
Oracle Health Sciences Information Manager: from 3.0.1 through 3.0.5; 3.0.0.1
Oracle Corporation iLearning: 6.2, 6.3
Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.58, 8.59
Oracle Corporation Primavera Gateway: from 17.7 through 17.12.11; from 18.8.0 through 18.8.14; from 19.12.0 through 19.12.13; from 20.12.0 through 20.12.8
Oracle Corporation Oracle Product Lifecycle Analytics: 3.6.1
Oracle Corporation Retail Bulk Data Integration: 16.0.3.0
Oracle Retail Extract Transform And Load: 13.2.8
Oracle Retail Financial Integration: 14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1
Oracle Corporation Oracle Retail Integration Bus: 14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1
Oracle Corporation Retail Merchandising System: 16.0.3, 19.0.1
Oracle Retail Service Backbone: 14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1
Oracle WebLogic Server: 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0

How to fix

Upgrade to a fixed version: Oracle Communications Element Manager 9.0; Oracle Communications Session Report Manager 9.0; Oracle Communications Session Route Manager 9.0; Oracle Corporation Financial Services Analytical Applications Infrastructure 8.1.2.0; Oracle Corporation Global Lifecycle Management NextGen OUI Framework 13.9.4.2.2; Oracle Global Lifecycle Management Opatch 12.2.0.1.30. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-23437 or the next vulnerability affects your stack