CVE-2022-23437 Infinite loop within Apache XercesJ xml parser

2022-01-2400:00:00

apache

www.cve.org

cve-2022-23437

apache xercesj

xml parser

infinite loop

AI Score

6.8

Confidence

High

EPSS

0.005

Percentile

76.1%

JSON

There’s a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.

CNA Affected

[
  {
    "vendor": "Apache Software Foundation",
    "product": "Apache Xerces",
    "versions": [
      {
        "version": "Apache XercesJ",
        "status": "affected",
        "lessThanOrEqual": "2.12.1",
        "versionType": "custom"
      }
    ]
  }
]