CVE-2022-23437 Infinite loop within Apache XercesJ xml parser

What is CVE-2022-23437?

CVE-2022-23437 is a medium-severity denial of service vulnerability in Netapp Active Iq Unified Manager, published on 24 Jan 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.

Weakness: CWE-835

Which versions are affected by CVE-2022-23437?

2 open source packages ship an affected version, including xerces:xercesImpl. It affects 29 products.

Products include Apache Xerces-J, Netapp Active Iq Unified Manager, Oracle Agile Engineering Data Management, Oracle Agile Product Lifecycle Management, Oracle Banking Deposits and Lines of Credit Servicing, Oracle Banking Party Management and 23 more.

How do I fix CVE-2022-23437?

Upgrade xerces:xercesImpl to 2.12.2 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-23437 being exploited?

There is no known exploitation of CVE-2022-23437 in the wild and no public exploit code.

Other vulnerabilities in Netapp Active Iq Unified Manager

• CVE-2018-2799 Denial of service in Java Medium 5.3

All Netapp Active Iq Unified Manager vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-109499, CLEANSTART-2026-HR57844, CLSA-2026-1774398091, DEBIAN-CVE-2022-23437, GHSA-h65f-jvqw-m9fj, OESA-2022-1625 and 8 more.