Medium 6.5Published Jan 23, 2022

CVE-2022-23437Infinite loop within Apache XercesJ xml parser

Updated under an hour ago (Oct 28, 2026, 3:00 AM ET)

Does this affect you?

It affects Apache Software Foundation Apache Xerces and 29 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Apache Software Foundation Apache Xerces

Exploited in the last 30 days

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.

CVSS: 6.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: apache
NVD analysis: Modified
Record last updated: Oct 8, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Apache Software Foundation Apache Xerces apache_software_foundation:apache_xerces (from the name)	from Apache XercesJ through 2.12.1	CNA record
apache xerces-j apache:xerces-j	through 2.12.1	NVD
oracle agile_engineering_data_management oracle:agile_engineering_data_management	6.2.1.0	NVD
oracle agile_product_lifecycle_management oracle:agile_product_lifecycle_management	9.3.6	NVD
oracle banking_deposits_and_lines_of_credit_servicing oracle:banking_deposits_and_lines_of_credit_servicing	2.7	NVD
oracle banking_party_management oracle:banking_party_management	2.7.0	NVD
oracle communications_asap oracle:communications_asap	7.3	NVD
oracle communications_element_manager oracle:communications_element_manager	before 9.0	NVD
oracle communications_session_report_manager oracle:communications_session_report_manager	before 9.0	NVD
oracle communications_session_route_manager oracle:communications_session_route_manager	before 9.0	NVD
1–10 of 30

References

References

https://lists.apache.org/thread/6pjwm10bb69kq955fzr1n0nflnjd27dl
http://www.openwall.com/lists/oss-security/2022/01/24/3	mailing-list
https://www.oracle.com/security-alerts/cpuapr2022.html
https://www.oracle.com/security-alerts/cpujul2022.html
https://security.netapp.com/advisory/ntap-20221028-0005/

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.