CVE-2022-23437
MediumCVSS 6.5Exploitation Probability (EPSS)
Very high risk96th percentile - higher than 96% of all known CVEs
Summary
The Apache Xerces Java (XercesJ) XML parser in version 2.12.1 and earlier is vulnerable to an infinite loop when handling specially crafted XML document payloads. This may cause the parser to wait indefinitely, potentially consuming system resources for a prolonged duration.
Risk Assessment
The risk is the possibility of a denial-of-service (DoS) attack, which could cause unavailability of applications using the parser.
Recommendation
Update Apache Xerces Java to a version newer than 2.12.1 that contains the fix. Also, restrict processing of untrusted XML documents.
Original NVD description (English source)
There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.