CVE-2022-23437
Infinite loop within Apache XercesJ xml parser
Vexday Risk Score
3Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS —EPSS 4.4%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
24 Jan 2022Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.
Affected products
Apache Software Foundation · Apache XercesWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →