CVE-2022-23437: Apache Xerces-J

Medium severity, CVSS 6.5. EPSS: 11.6% chance of exploitation in the next 30 days.

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.

Affected products

Apache Xerces-J: up to and including 2.12.1
Netapp Active Iq Unified Manager: affected versions not specified
Oracle Agile Engineering Data Management: version 6.2.1.0 only
Oracle Agile Product Lifecycle Management: version 9.3.6 only
Oracle Banking Deposits And Lines Of Credit Servicing: version 2.7 only
Oracle Banking Party Management: version 2.7.0 only
Oracle Communications Asap: version 7.3 only
Oracle Communications Element Manager: before 9.0 (fixed in 9.0)
Oracle Communications Session Report Manager: before 9.0 (fixed in 9.0)
Oracle Communications Session Route Manager: before 9.0 (fixed in 9.0)
Oracle Financial Services Analytical Applications Infrastructure: from 8.0.6.0.0, up to and including 8.0.9.0; from 8.1.0.0, before 8.1.2.0 (fixed in 8.1.2.0)
Oracle Financial Services Behavior Detection Platform: from 8.0.6.0.0, up to and including 8.0.8.0; version 8.1.1.0 only; version 8.1.1.1 only; version 8.1.2.0 only
Oracle Financial Services Crime And Compliance Management Studio: version 8.0.8.2.0 only; version 8.0.8.3.0 only
Oracle Financial Services Enterprise Case Management: version 8.0.7.1 only; version 8.0.7.2.0 only; version 8.0.8.0 only; version 8.0.8.1 only; version 8.1.1.0 only; version 8.1.1.1 only
Oracle Flexcube Universal Banking: version 12.4.0 only
Oracle Global Lifecycle Management NextGen Oui Framework: before 13.9.4.2.2 (fixed in 13.9.4.2.2); version 13.9.4.2.2 only
Oracle Global Lifecycle Management Opatch: before 12.2.0.1.30 (fixed in 12.2.0.1.30)
Oracle Health Sciences Information Manager: from 3.0.1, up to and including 3.0.5; version 3.0.0.1 only
Oracle Ilearning: version 6.2 only; version 6.3 only
Oracle PeopleSoft Enterprise PeopleTools: version 8.58 only; version 8.59 only
Oracle Primavera Gateway: from 17.7, up to and including 17.12.11; from 18.8.0, up to and including 18.8.14; from 19.12.0, up to and including 19.12.13; from 20.12.0, up to and including 20.12.8
Oracle Product Lifecycle Analytics: version 3.6.1 only
Oracle Retail Bulk Data Integration: version 16.0.3.0 only
Oracle Retail Extract Transform And Load: version 13.2.8 only
Oracle Retail Financial Integration: version 14.1.3.2 only; version 15.0.3.1 only; version 16.0.3 only; version 19.0.1 only
and 4 more

Published 2022-01-24. Last modified 2026-10-08.