Every CVE Search/ Get API key

CVE-2022-23437

Infinite loop within Apache XercesJ xml parser

6.5 MediumFix available

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

11.6%Up 10.7 points since Feb 8, 2022
90%50%10%1%

What each source reports

NVD Score used 6.5

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.

Record
CVE-2022-23437
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0
7.1 HighAV:N/AC:M/Au:N/C:N/I:N/A:C
Weakness
CWE-835
Updated
2026-11-02
CVE List No score

Infinite loop within Apache XercesJ xml parser

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.

Record
CVE-2022-23437
Updated
2026-11-02
EUVDEUVD-2022-0613 No score

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.

Record
EUVD-2022-0613
Updated
2026-11-02
GitHub AdvisoriesGHSA-h65f-jvqw-m9fj 6.5

Infinite Loop in Apache Xerces Java

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.

Record
GHSA-h65f-jvqw-m9fj
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-91
Updated
2026-11-02
OSVAZL-109499 6.5

CVE-2022-23437 affecting package xerces-j2 2.12.0-6

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.

Record
AZL-109499
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 6.5

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.

Record
CVE-2022-23437
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 21 moreShow less
OSVDEBIAN-CVE-2022-23437 6.5

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.

Record
DEBIAN-CVE-2022-23437
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSVGHSA-h65f-jvqw-m9fj 6.5

Infinite Loop in Apache Xerces Java

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.

Record
GHSA-h65f-jvqw-m9fj
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-91
Updated
2026-11-02
OSVOESA-2022-1625 6.5

xerces-j2 security update

Welcome to the future! Xerces2 is the next generation of high performance, fully compliant XML parsers in the Apache Xerces family. This new version of Xerces introduces the Xerces Native Interface (XNI), a complete framework for building parser components and configurations that is extremely modular and easy to program.

The Apache Xerces2 parser is the reference implementation of XNI but other parser components, configurations, and parsers can be written using the Xerces Native Interface. For complete design and implementation documents, refer to the XNI Manual.

Xerces 2 is a fully conforming XML Schema processor. For more information, refer to the XML Schema page.

Xerces 2 also provides a partial implementation of Document Object Model Level 3 Core, Load and Save and Abstract Schemas [deprecated] Working Drafts. For more information, refer to the DOM Level 3 Implementation page.

Security Fix(es):

There s a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.(CVE-2022-23437)

Record
OESA-2022-1625
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2022:4918 9.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.5 security update on RHEL 7

Record
RHSA-2022:4918
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:4919 9.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.5 security update on RHEL 8

Record
RHSA-2022:4919
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2022-23437 6.5

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.

Record
UBUNTU-CVE-2022-23437
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVCLSA-2026-1770336546 No score

TuxCare security update for xerces:xercesImpl (5 CVEs)

TuxCare rebuilt xerces:xercesImpl to address 5 CVEs. Fixed in 2.11.0-tuxcare.1.

Record
CLSA-2026-1770336546
Updated
2026-11-02
OSVCLSA-2026-1774398091 No score

TuxCare security update for xerces:xercesImpl (1 CVE)

TuxCare rebuilt xerces:xercesImpl to address 1 CVE. Fixed in 2.12.0-tuxcare.1.

Record
CLSA-2026-1774398091
Updated
2026-11-02
OSVCLSA-2026-1788215347 No score

TuxCare security update for org.apache.logging.log4j (7 CVEs)

TuxCare rebuilt 23 org.apache.logging.log4j packages to address 7 CVEs. Fixed in 2.11.0-tuxcare.1.

Record
CLSA-2026-1788215347
Updated
2026-11-02
OSVopenSUSE-SU-2022:0500-1 No score

Security update for xerces-j2

This update for xerces-j2 fixes the following issues:

  • CVE-2022-23437: Fixed infinite loop within Apache XercesJ xml parser (bsc#1195108).
Record
openSUSE-SU-2022:0500-1
Updated
2026-11-02
OSVopenSUSE-SU-2022:0503-1 No score

Security update for xerces-j2

This update for xerces-j2 fixes the following issues:

  • CVE-2022-23437: Fixed infinite loop within Apache XercesJ xml parser (bsc#1195108).
Record
openSUSE-SU-2022:0503-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11845-1 No score

xerces-j2-2.12.2-1.1 on GA media

These are all security issues fixed in the xerces-j2-2.12.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11845-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11999-1 No score

ruby3.1-rubygem-nokogiri-1.13.4-1.1 on GA media

These are all security issues fixed in the ruby3.1-rubygem-nokogiri-1.13.4-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11999-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:13165-1 No score

ruby3.2-rubygem-nokogiri-1.13.9-1.7 on GA media

These are all security issues fixed in the ruby3.2-rubygem-nokogiri-1.13.9-1.7 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13165-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14174-1 No score

ruby3.3-rubygem-nokogiri-1.15.5-1.5 on GA media

These are all security issues fixed in the ruby3.3-rubygem-nokogiri-1.15.5-1.5 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14174-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:14697-1 No score

ruby3.4-rubygem-nokogiri-1.18.2-1.1 on GA media

These are all security issues fixed in the ruby3.4-rubygem-nokogiri-1.18.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:14697-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:10356-1 No score

ruby4.0-rubygem-nokogiri-1.18.9-1.4 on GA media

These are all security issues fixed in the ruby4.0-rubygem-nokogiri-1.18.9-1.4 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10356-1
Updated
2026-11-02
OSVSUSE-SU-2022:0500-1 No score

Security update for xerces-j2

This update for xerces-j2 fixes the following issues:

  • CVE-2022-23437: Fixed infinite loop within Apache XercesJ xml parser (bsc#1195108).
Record
SUSE-SU-2022:0500-1
Updated
2026-11-02
OSVSUSE-SU-2022:0503-1 No score

Security update for xerces-j2

This update for xerces-j2 fixes the following issues:

  • CVE-2022-23437: Fixed infinite loop within Apache XercesJ xml parser (bsc#1195108).
Record
SUSE-SU-2022:0503-1
Updated
2026-11-02
OSVSUSE-SU-2022:0542-1 No score

Security update for xerces-j2

This update for xerces-j2 fixes the following issues:

  • CVE-2022-23437: Fixed infinite loop within Apache XercesJ xml parser (bsc#1195108).
Record
SUSE-SU-2022:0542-1
Updated
2026-11-02
OSVSUSE-SU-2022:14889-1 No score

Security update for xerces-j2

This update for xerces-j2 fixes the following issues:

  • CVE-2022-23437: Fixed infinite loop within Apache XercesJ xml parser (bsc#1195108).
Record
SUSE-SU-2022:14889-1
Updated
2026-11-02

Affected products

Show 18 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
xerces:xercesImpl
Maven
before 2.12.2
2.12.2
xerces-j2
Azure Linux:3
through 2.12.0-6 None known
xerces:xercesImpl
TuxCare:Maven
2.11.0 up to 2.11.0-tuxcare.1
2.11.0-tuxcare.1
xerces:xercesImpl
TuxCare:Maven
2.12.0 up to 2.12.0-tuxcare.1
2.12.0-tuxcare.1
libxerces2-java
Debian:12
before 2.12.2-1
2.12.2-1
libxerces2-java
Debian:13
before 2.12.2-1
2.12.2-1
libxerces2-java
Debian:14
before 2.12.2-1
2.12.2-1
xerces:xercesImpl
Maven
before 2.12.2, plus listed versions
2.0.02.0.22.10.02.11.02.12.0
Show 14 moreShow less
2.12.12.2.12.3.02.4.02.5.02.6.02.6.12.6.22.6.2-jaxb-1.0.62.7.12.8.02.8.12.9.02.9.1
2.12.2
xerces-j2
openEuler:20.03-LTS-SP1
before 2.12.2-1.oe1
2.12.2-1.oe1
xerces-j2
openEuler:20.03-LTS-SP2
before 2.12.2-1.oe1
2.12.2-1.oe1
Show 174 moreShow less
Affected packages
PackageAffectedFixed
xerces-j2
openEuler:20.03-LTS-SP3
before 2.12.2-1.oe1
2.12.2-1.oe1
xerces-j2
openEuler:22.03-LTS
before 2.12.2-1.oe2203
2.12.2-1.oe2203
eap7-jackson-databind
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:2.12.6.1-1.redhat_00003.1.el7eap
0:2.12.6.1-1.redhat_00003.1.el7eap
eap7-netty
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-all
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-buffer
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-codec
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-codec-dns
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-codec-haproxy
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-codec-http
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-codec-http2
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-codec-memcache
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-codec-mqtt
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-codec-redis
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-codec-smtp
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-codec-socks
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-codec-stomp
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-codec-xml
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-common
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-handler
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-handler-proxy
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-resolver
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-resolver-dns
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-resolver-dns-classes-macos
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-transport
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-transport-classes-epoll
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-transport-classes-kqueue
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-transport-native-unix-common
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-transport-rxtx
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-transport-sctp
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-transport-udt
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-h2database
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:1.4.197-2.redhat_00004.1.el7eap
0:1.4.197-2.redhat_00004.1.el7eap
eap7-jboss-xnio-base
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:3.8.7-1.SP1_redhat_00001.1.el7eap
0:3.8.7-1.SP1_redhat_00001.1.el7eap
eap7-wildfly-http-client
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:1.1.11-1.SP1_redhat_00001.1.el7eap
0:1.1.11-1.SP1_redhat_00001.1.el7eap
eap7-wildfly-http-client-common
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:1.1.11-1.SP1_redhat_00001.1.el7eap
0:1.1.11-1.SP1_redhat_00001.1.el7eap
eap7-wildfly-http-ejb-client
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:1.1.11-1.SP1_redhat_00001.1.el7eap
0:1.1.11-1.SP1_redhat_00001.1.el7eap
eap7-wildfly-http-naming-client
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:1.1.11-1.SP1_redhat_00001.1.el7eap
0:1.1.11-1.SP1_redhat_00001.1.el7eap
eap7-wildfly-http-transaction-client
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:1.1.11-1.SP1_redhat_00001.1.el7eap
0:1.1.11-1.SP1_redhat_00001.1.el7eap
eap7-wildfly
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:7.4.5-3.GA_redhat_00001.1.el7eap
0:7.4.5-3.GA_redhat_00001.1.el7eap
eap7-wildfly-java-jdk11
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:7.4.5-3.GA_redhat_00001.1.el7eap
0:7.4.5-3.GA_redhat_00001.1.el7eap
eap7-wildfly-java-jdk8
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:7.4.5-3.GA_redhat_00001.1.el7eap
0:7.4.5-3.GA_redhat_00001.1.el7eap
eap7-wildfly-javadocs
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:7.4.5-3.GA_redhat_00001.1.el7eap
0:7.4.5-3.GA_redhat_00001.1.el7eap
eap7-wildfly-modules
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:7.4.5-3.GA_redhat_00001.1.el7eap
0:7.4.5-3.GA_redhat_00001.1.el7eap
eap7-undertow
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:2.2.17-2.SP4_redhat_00001.1.el7eap
0:2.2.17-2.SP4_redhat_00001.1.el7eap
eap7-xerces-j2
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:2.12.0-3.SP04_redhat_00001.1.el7eap
0:2.12.0-3.SP04_redhat_00001.1.el7eap
eap7-activemq-artemis
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:2.16.0-9.redhat_00042.1.el7eap
0:2.16.0-9.redhat_00042.1.el7eap
eap7-activemq-artemis-cli
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:2.16.0-9.redhat_00042.1.el7eap
0:2.16.0-9.redhat_00042.1.el7eap
eap7-activemq-artemis-commons
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:2.16.0-9.redhat_00042.1.el7eap
0:2.16.0-9.redhat_00042.1.el7eap
eap7-activemq-artemis-core-client
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:2.16.0-9.redhat_00042.1.el7eap
0:2.16.0-9.redhat_00042.1.el7eap
eap7-activemq-artemis-dto
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:2.16.0-9.redhat_00042.1.el7eap
0:2.16.0-9.redhat_00042.1.el7eap
eap7-activemq-artemis-hornetq-protocol
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:2.16.0-9.redhat_00042.1.el7eap
0:2.16.0-9.redhat_00042.1.el7eap
eap7-activemq-artemis-hqclient-protocol
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:2.16.0-9.redhat_00042.1.el7eap
0:2.16.0-9.redhat_00042.1.el7eap
eap7-activemq-artemis-jdbc-store
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:2.16.0-9.redhat_00042.1.el7eap
0:2.16.0-9.redhat_00042.1.el7eap
eap7-activemq-artemis-jms-client
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:2.16.0-9.redhat_00042.1.el7eap
0:2.16.0-9.redhat_00042.1.el7eap
eap7-activemq-artemis-jms-server
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:2.16.0-9.redhat_00042.1.el7eap
0:2.16.0-9.redhat_00042.1.el7eap
eap7-activemq-artemis-journal
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:2.16.0-9.redhat_00042.1.el7eap
0:2.16.0-9.redhat_00042.1.el7eap
eap7-activemq-artemis-ra
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:2.16.0-9.redhat_00042.1.el7eap
0:2.16.0-9.redhat_00042.1.el7eap
eap7-activemq-artemis-selector
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:2.16.0-9.redhat_00042.1.el7eap
0:2.16.0-9.redhat_00042.1.el7eap
eap7-activemq-artemis-server
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:2.16.0-9.redhat_00042.1.el7eap
0:2.16.0-9.redhat_00042.1.el7eap
eap7-activemq-artemis-service-extensions
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:2.16.0-9.redhat_00042.1.el7eap
0:2.16.0-9.redhat_00042.1.el7eap
eap7-activemq-artemis-tools
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:2.16.0-9.redhat_00042.1.el7eap
0:2.16.0-9.redhat_00042.1.el7eap
eap7-hal-console
Red Hat:jboss_enterprise_application_platform:7.4::el7
before 0:3.3.12-1.Final_redhat_00001.1.el7eap
0:3.3.12-1.Final_redhat_00001.1.el7eap
eap7-jackson-databind
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:2.12.6.1-1.redhat_00003.1.el8eap
0:2.12.6.1-1.redhat_00003.1.el8eap
eap7-netty
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-all
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-buffer
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-codec
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-codec-dns
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-codec-haproxy
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-codec-http
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-codec-http2
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-codec-memcache
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-codec-mqtt
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-codec-redis
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-codec-smtp
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-codec-socks
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-codec-stomp
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-codec-xml
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-common
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-handler
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-handler-proxy
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-resolver
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-resolver-dns
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-resolver-dns-classes-macos
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-transport
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-transport-classes-epoll
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-transport-classes-kqueue
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-transport-native-unix-common
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-transport-rxtx
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-transport-sctp
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-transport-udt
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-h2database
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:1.4.197-2.redhat_00004.1.el8eap
0:1.4.197-2.redhat_00004.1.el8eap
eap7-jboss-xnio-base
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:3.8.7-1.SP1_redhat_00001.1.el8eap
0:3.8.7-1.SP1_redhat_00001.1.el8eap
eap7-wildfly-http-client
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:1.1.11-1.SP1_redhat_00001.1.el8eap
0:1.1.11-1.SP1_redhat_00001.1.el8eap
eap7-wildfly-http-client-common
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:1.1.11-1.SP1_redhat_00001.1.el8eap
0:1.1.11-1.SP1_redhat_00001.1.el8eap
eap7-wildfly-http-ejb-client
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:1.1.11-1.SP1_redhat_00001.1.el8eap
0:1.1.11-1.SP1_redhat_00001.1.el8eap
eap7-wildfly-http-naming-client
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:1.1.11-1.SP1_redhat_00001.1.el8eap
0:1.1.11-1.SP1_redhat_00001.1.el8eap
eap7-wildfly-http-transaction-client
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:1.1.11-1.SP1_redhat_00001.1.el8eap
0:1.1.11-1.SP1_redhat_00001.1.el8eap
eap7-wildfly
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:7.4.5-3.GA_redhat_00001.1.el8eap
0:7.4.5-3.GA_redhat_00001.1.el8eap
eap7-wildfly-javadocs
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:7.4.5-3.GA_redhat_00001.1.el8eap
0:7.4.5-3.GA_redhat_00001.1.el8eap
eap7-wildfly-modules
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:7.4.5-3.GA_redhat_00001.1.el8eap
0:7.4.5-3.GA_redhat_00001.1.el8eap
eap7-undertow
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:2.2.17-2.SP4_redhat_00001.1.el8eap
0:2.2.17-2.SP4_redhat_00001.1.el8eap
eap7-xerces-j2
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:2.12.0-3.SP04_redhat_00001.1.el8eap
0:2.12.0-3.SP04_redhat_00001.1.el8eap
eap7-activemq-artemis
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:2.16.0-9.redhat_00042.1.el8eap
0:2.16.0-9.redhat_00042.1.el8eap
eap7-activemq-artemis-cli
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:2.16.0-9.redhat_00042.1.el8eap
0:2.16.0-9.redhat_00042.1.el8eap
eap7-activemq-artemis-commons
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:2.16.0-9.redhat_00042.1.el8eap
0:2.16.0-9.redhat_00042.1.el8eap
eap7-activemq-artemis-core-client
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:2.16.0-9.redhat_00042.1.el8eap
0:2.16.0-9.redhat_00042.1.el8eap
eap7-activemq-artemis-dto
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:2.16.0-9.redhat_00042.1.el8eap
0:2.16.0-9.redhat_00042.1.el8eap
eap7-activemq-artemis-hornetq-protocol
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:2.16.0-9.redhat_00042.1.el8eap
0:2.16.0-9.redhat_00042.1.el8eap
eap7-activemq-artemis-hqclient-protocol
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:2.16.0-9.redhat_00042.1.el8eap
0:2.16.0-9.redhat_00042.1.el8eap
eap7-activemq-artemis-jdbc-store
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:2.16.0-9.redhat_00042.1.el8eap
0:2.16.0-9.redhat_00042.1.el8eap
eap7-activemq-artemis-jms-client
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:2.16.0-9.redhat_00042.1.el8eap
0:2.16.0-9.redhat_00042.1.el8eap
eap7-activemq-artemis-jms-server
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:2.16.0-9.redhat_00042.1.el8eap
0:2.16.0-9.redhat_00042.1.el8eap
eap7-activemq-artemis-journal
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:2.16.0-9.redhat_00042.1.el8eap
0:2.16.0-9.redhat_00042.1.el8eap
eap7-activemq-artemis-ra
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:2.16.0-9.redhat_00042.1.el8eap
0:2.16.0-9.redhat_00042.1.el8eap
eap7-activemq-artemis-selector
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:2.16.0-9.redhat_00042.1.el8eap
0:2.16.0-9.redhat_00042.1.el8eap
eap7-activemq-artemis-server
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:2.16.0-9.redhat_00042.1.el8eap
0:2.16.0-9.redhat_00042.1.el8eap
eap7-activemq-artemis-service-extensions
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:2.16.0-9.redhat_00042.1.el8eap
0:2.16.0-9.redhat_00042.1.el8eap
eap7-activemq-artemis-tools
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:2.16.0-9.redhat_00042.1.el8eap
0:2.16.0-9.redhat_00042.1.el8eap
eap7-hal-console
Red Hat:jboss_enterprise_application_platform:7.4::el8
before 0:3.3.12-1.Final_redhat_00001.1.el8eap
0:3.3.12-1.Final_redhat_00001.1.el8eap
xerces-j2
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
before 2.11.0-4.3.1
2.11.0-4.3.1
xerces-j2
SUSE:Linux Enterprise High Performance Computing 15-LTSS
before 2.11.0-4.3.1
2.11.0-4.3.1
xerces-j2
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
before 2.11.0-4.3.1
2.11.0-4.3.1
xerces-j2
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
before 2.11.0-4.3.1
2.11.0-4.3.1
xerces-j2
SUSE:Linux Enterprise Server 15-LTSS
before 2.11.0-4.3.1
2.11.0-4.3.1
xerces-j2
SUSE:Linux Enterprise Server 15 SP1-BCL
before 2.11.0-4.3.1
2.11.0-4.3.1
xerces-j2
SUSE:Linux Enterprise Server 15 SP1-LTSS
before 2.11.0-4.3.1
2.11.0-4.3.1
xerces-j2
SUSE:Linux Enterprise Server for SAP Applications 15
before 2.11.0-4.3.1
2.11.0-4.3.1
xerces-j2
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
before 2.11.0-4.3.1
2.11.0-4.3.1
xerces-j2
SUSE:Enterprise Storage 6
before 2.11.0-4.3.1
2.11.0-4.3.1
xerces-j2
SUSE:Linux Enterprise Module for Basesystem 15 SP3
before 2.12.0-3.3.1
2.12.0-3.3.1
xerces-j2
SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS
before 2.12.0-3.3.1
2.12.0-3.3.1
xerces-j2
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
before 2.12.0-3.3.1
2.12.0-3.3.1
xerces-j2
SUSE:Linux Enterprise Real Time 15 SP2
before 2.12.0-3.3.1
2.12.0-3.3.1
xerces-j2
SUSE:Linux Enterprise Server 15 SP2-BCL
before 2.12.0-3.3.1
2.12.0-3.3.1
xerces-j2
SUSE:Linux Enterprise Server 15 SP2-LTSS
before 2.12.0-3.3.1
2.12.0-3.3.1
xerces-j2
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
before 2.12.0-3.3.1
2.12.0-3.3.1
xerces-j2
SUSE:Manager Proxy 4.1
before 2.12.0-3.3.1
2.12.0-3.3.1
xerces-j2
SUSE:Manager Retail Branch Server 4.1
before 2.12.0-3.3.1
2.12.0-3.3.1
xerces-j2
SUSE:Manager Server 4.1
before 2.12.0-3.3.1
2.12.0-3.3.1
xerces-j2
SUSE:Enterprise Storage 7
before 2.12.0-3.3.1
2.12.0-3.3.1
xerces-j2
SUSE:HPE Helion OpenStack 8
before 2.8.1-268.9.1
2.8.1-268.9.1
xerces-j2
SUSE:OpenStack Cloud 8
before 2.8.1-268.9.1
2.8.1-268.9.1
xerces-j2
SUSE:OpenStack Cloud 9
before 2.8.1-268.9.1
2.8.1-268.9.1
xerces-j2
SUSE:OpenStack Cloud Crowbar 8
before 2.8.1-268.9.1
2.8.1-268.9.1
xerces-j2
SUSE:OpenStack Cloud Crowbar 9
before 2.8.1-268.9.1
2.8.1-268.9.1
xerces-j2
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
before 2.8.1-268.9.1
2.8.1-268.9.1
xerces-j2
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
before 2.8.1-268.9.1
2.8.1-268.9.1
xerces-j2
SUSE:Linux Enterprise Software Development Kit 12 SP5
before 2.8.1-268.9.1
2.8.1-268.9.1
xerces-j2
SUSE:Linux Enterprise Server 12 SP2-BCL
before 2.8.1-268.9.1
2.8.1-268.9.1
xerces-j2
SUSE:Linux Enterprise Server 12 SP3-LTSS
before 2.8.1-268.9.1
2.8.1-268.9.1
xerces-j2
SUSE:Linux Enterprise Server 12 SP3-BCL
before 2.8.1-268.9.1
2.8.1-268.9.1
xerces-j2
SUSE:Linux Enterprise Server 12 SP4-LTSS
before 2.8.1-268.9.1
2.8.1-268.9.1
xerces-j2
SUSE:Linux Enterprise Server 12 SP5
before 2.8.1-268.9.1
2.8.1-268.9.1
xerces-j2
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
before 2.8.1-268.9.1
2.8.1-268.9.1
xerces-j2
SUSE:Linux Enterprise Point of Sale 11 SP3
before 2.8.1-238.29.8.1
2.8.1-238.29.8.1
xerces-j2
SUSE:Linux Enterprise Server 11 SP4-LTSS
before 2.8.1-238.29.8.1
2.8.1-238.29.8.1
libxerces2-java
Ubuntu:14.04:LTS
All versions, plus listed versions
2.11.0-7
None known
libxerces2-java
Ubuntu:16.04:LTS
All versions, plus listed versions
2.11.0-7
None known
libxerces2-java
Ubuntu:18.04:LTS
All versions, plus listed versions
2.11.0-8
None known
libxerces2-java
Ubuntu:20.04:LTS
All versions, plus listed versions
2.12.0-12.12.1-1
None known
libxerces2-java
Ubuntu:22.04:LTS
All versions, plus listed versions
2.12.1-1
None known
libxerces2-java
Ubuntu:24.04:LTS
All versions, plus listed versions
2.12.2-1
None known
libxerces2-java
Ubuntu:25.10
All versions, plus listed versions
2.12.2-1
None known
libxerces2-java
Ubuntu:26.10
All versions, plus listed versions
2.12.2-1
None known
libxerces2-java
Ubuntu:26.04:LTS
All versions, plus listed versions
2.12.2-1
None known
xerces-j2
openSUSE:Leap 15.3
before 2.11.0-4.3.1
2.11.0-4.3.1
xerces-j2
openSUSE:Leap 15.3
before 2.12.0-3.3.1
2.12.0-3.3.1
xerces-j2
openSUSE:Tumbleweed
before 2.12.2-1.1
2.12.2-1.1
rubygem-nokogiri
openSUSE:Tumbleweed
before 1.13.4-1.1
1.13.4-1.1
ruby3.2-rubygem-nokogiri
openSUSE:Tumbleweed
before 1.13.9-1.7
1.13.9-1.7
rubygem-nokogiri
openSUSE:Tumbleweed
before 1.15.5-1.5
1.15.5-1.5
rubygem-nokogiri
openSUSE:Tumbleweed
before 1.18.2-1.1
1.18.2-1.1
rubygem-nokogiri
openSUSE:Tumbleweed
before 1.18.9-1.4
1.18.9-1.4

History

History
RecordedChangedSources
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-23437 is a medium vulnerability (CVSS 6.5) in Apache Software Foundation Xerces, published January 24, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 11.6%, the 96th percentile. Fixed in xerces:xercesImpl 2.12.2.

References

Show 145 moreShow less
MoveEnter Open