CVE-2022-34169: Apache Xalan-Java

High severity, CVSS 7.5. EPSS: 81.8% chance of exploitation in the next 30 days.

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.

Affected products

Apache Xalan-Java: up to and including 2.7.2
Azul Zulu: version 6.47 only; version 7.54 only; version 8.62 only; version 11.56 only; version 13.48 only; version 15.40 only; …
Debian Debian Linux: version 10.0 only; version 11.0 only
Fedoraproject Fedora: version 35 only; version 36 only
Netapp 7-Mode Transition Tool: affected versions not specified
Netapp Active Iq Unified Manager: affected versions not specified
Netapp Cloud Insights Acquisition Unit: affected versions not specified
Netapp Cloud Secure Agent: affected versions not specified
Netapp Hci Compute Node: affected versions not specified
Netapp Hci Management Node: affected versions not specified
Netapp Oncommand Insight: affected versions not specified
Netapp Solidfire: affected versions not specified
Oracle Graalvm: version 20.3.6 only; version 21.3.2 only; version 22.1.0 only
Oracle JDK: version 1.7.0 only; version 1.8.0 only; version 11.0.15.1 only; version 17.0.3.1 only; version 18.0.1.1 only
Oracle JRE: version 1.7.0 only; version 1.8.0 only; version 11.0.15.1 only; version 17.0.3.1 only; version 18.0.1.1 only
Oracle Openjdk: from 11, up to and including 11.0.15; from 13, up to and including 13.0.11; from 15, up to and including 15.0.7; from 17, up to and including 17.0.3; version 7 only; version 8 only; …

Published 2022-07-19. Last modified 2026-06-17.