{"id":"CVE-2022-23437","details":"There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.","aliases":["GHSA-h65f-jvqw-m9fj"],"modified":"2026-04-10T04:44:45.368698Z","published":"2022-01-24T15:15:09.317Z","related":["SUSE-SU-2022:0500-1","SUSE-SU-2022:0503-1","SUSE-SU-2022:0542-1","SUSE-SU-2022:14889-1","openSUSE-SU-2022:0500-1","openSUSE-SU-2022:0503-1","openSUSE-SU-2024:11845-1","openSUSE-SU-2024:11999-1","openSUSE-SU-2024:13165-1","openSUSE-SU-2024:14174-1","openSUSE-SU-2025:14697-1","openSUSE-SU-2026:10356-1"],"references":[{"type":"ADVISORY","url":"http://www.openwall.com/lists/oss-security/2022/01/24/3"},{"type":"ADVISORY","url":"https://lists.apache.org/thread/6pjwm10bb69kq955fzr1n0nflnjd27dl"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20221028-0005/"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpujul2022.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpuapr2022.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/xerces2-j","events":[{"introduced":"0"},{"last_affected":"c9862305e4876e529d8fdba96639f1c3c196a87b"},{"introduced":"0"},{"last_affected":"c9862305e4876e529d8fdba96639f1c3c196a87b"}],"database_specific":{"versions":[{"introduced":"0"},{"last_affected":"2.7"},{"introduced":"0"},{"last_affected":"2.7.0"}]}}],"versions":["Xerces-J_2_7_0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-23437.json","unresolved_ranges":[{"events":[{"introduced":"0"},{"last_affected":"2.12.1"}]},{"events":[{"introduced":"0"},{"last_affected":"6.2.1.0"}]},{"events":[{"introduced":"0"},{"last_affected":"9.3.6"}]},{"events":[{"introduced":"0"},{"last_affected":"7.3"}]},{"events":[{"introduced":"0"},{"fixed":"9.0"}]},{"events":[{"introduced":"0"},{"fixed":"9.0"}]},{"events":[{"introduced":"0"},{"fixed":"9.0"}]},{"events":[{"introduced":"8.0.6.0.0"},{"last_affected":"8.0.9.0"}]},{"events":[{"introduced":"8.1.0.0"},{"fixed":"8.1.2.0"}]},{"events":[{"introduced":"8.0.6.0.0"},{"last_affected":"8.0.8.0"}]},{"events":[{"introduced":"0"},{"last_affected":"8.1.1.0"}]},{"events":[{"introduced":"0"},{"last_affected":"8.1.1.1"}]},{"events":[{"introduced":"0"},{"last_affected":"8.1.2.0"}]},{"events":[{"introduced":"0"},{"last_affected":"8.0.8.2.0"}]},{"events":[{"introduced":"0"},{"last_affected":"8.0.8.3.0"}]},{"events":[{"introduced":"0"},{"last_affected":"8.0.7.1"}]},{"events":[{"introduced":"0"},{"last_affected":"8.0.7.2.0"}]},{"events":[{"introduced":"0"},{"last_affected":"8.0.8.0"}]},{"events":[{"introduced":"0"},{"last_affected":"8.0.8.1"}]},{"events":[{"introduced":"0"},{"last_affected":"8.1.1.0"}]},{"events":[{"introduced":"0"},{"last_affected":"8.1.1.1"}]},{"events":[{"introduced":"0"},{"last_affected":"12.4.0"}]},{"events":[{"introduced":"0"},{"fixed":"13.9.4.2.2"}]},{"events":[{"introduced":"0"},{"last_affected":"13.9.4.2.2"}]},{"events":[{"introduced":"0"},{"fixed":"12.2.0.1.30"}]},{"events":[{"introduced":"3.0.1"},{"last_affected":"3.0.5"}]},{"events":[{"introduced":"0"},{"last_affected":"3.0.0.1"}]},{"events":[{"introduced":"0"},{"last_affected":"6.2"}]},{"events":[{"introduced":"0"},{"last_affected":"6.3"}]},{"events":[{"introduced":"0"},{"last_affected":"8.58"}]},{"events":[{"introduced":"0"},{"last_affected":"8.59"}]},{"events":[{"introduced":"17.7"},{"last_affected":"17.12.11"}]},{"events":[{"introduced":"18.8.0"},{"last_affected":"18.8.14"}]},{"events":[{"introduced":"19.12.0"},{"last_affected":"19.12.13"}]},{"events":[{"introduced":"20.12.0"},{"last_affected":"20.12.8"}]},{"events":[{"introduced":"0"},{"last_affected":"3.6.1"}]},{"events":[{"introduced":"0"},{"last_affected":"16.0.3.0"}]},{"events":[{"introduced":"0"},{"last_affected":"13.2.8"}]},{"events":[{"introduced":"0"},{"last_affected":"14.1.3.2"}]},{"events":[{"introduced":"0"},{"last_affected":"15.0.3.1"}]},{"events":[{"introduced":"0"},{"last_affected":"16.0.3"}]},{"events":[{"introduced":"0"},{"last_affected":"19.0.1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.1.3.2"}]},{"events":[{"introduced":"0"},{"last_affected":"15.0.3.1"}]},{"events":[{"introduced":"0"},{"last_affected":"16.0.3"}]},{"events":[{"introduced":"0"},{"last_affected":"19.0.1"}]},{"events":[{"introduced":"0"},{"last_affected":"16.0.3"}]},{"events":[{"introduced":"0"},{"last_affected":"19.0.1"}]},{"events":[{"introduced":"0"},{"last_affected":"14.1.3.2"}]},{"events":[{"introduced":"0"},{"last_affected":"15.0.3.1"}]},{"events":[{"introduced":"0"},{"last_affected":"16.0.3"}]},{"events":[{"introduced":"0"},{"last_affected":"19.0.1"}]},{"events":[{"introduced":"0"},{"last_affected":"12.2.1.3.0"}]},{"events":[{"introduced":"0"},{"last_affected":"12.2.1.4.0"}]},{"events":[{"introduced":"0"},{"last_affected":"14.1.1.0.0"}]}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}