What’s Vulnerable › Vulnerabilities

CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 81.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-07-19 · updated 2026-06-17
• Weakness: CWE-681

Description

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.

Affected products

• Apache Xalan-Java: through 2.7.2
• Azul Zulu: 6.47, 7.54, 8.62, 11.56, 13.48, 15.40 (+2)
• Debian Linux: 10.0, 11.0
• Fedoraproject Fedora: 35, 36
• NetApp 7-Mode Transition Tool: all versions
• Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
• NetApp Cloud Insights Acquisition Unit: all versions
• NetApp Cloud Secure Agent: all versions
• NetApp Hci Compute Node: all versions
• NetApp Hci Management Node: all versions
• OnCommand Insight: all versions
• NetApp Solidfire: all versions
• Oracle Corporation GraalVM Enterprise Edition: 20.3.6, 21.3.2, 22.1.0
• Oracle Java SE: 1.7.0-update343, 1.8.0-update333, 11.0.15.1, 17.0.3.1, 18.0.1.1
• Oracle Java SE: 1.7.0-update343, 1.8.0-update333, 11.0.15.1, 17.0.3.1, 18.0.1.1
• containers/openjdk: from 11 through 11.0.15; from 13 through 13.0.11; from 15 through 15.0.7; from 17 through 17.0.3; 7, 7-update1, 7-update10, 7-update101, 7-update11, 7-update111 (+114)

References

• http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.html
• http://www.openwall.com/lists/oss-security/2022/07/19/5
• http://www.openwall.com/lists/oss-security/2022/07/19/6
• http://www.openwall.com/lists/oss-security/2022/07/20/2
• http://www.openwall.com/lists/oss-security/2022/07/20/3
• http://www.openwall.com/lists/oss-security/2022/10/18/2
• http://www.openwall.com/lists/oss-security/2022/11/04/8
• http://www.openwall.com/lists/oss-security/2022/11/07/2
• https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kyw
• https://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8
• https://lists.debian.org/debian-lts-announce/2022/10/msg00024.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/

Get alerted when CVE-2022-34169 or the next vulnerability affects your stack