# CVE-2022-23437: Infinite loop within Apache XercesJ xml parser > An attacker can cause a denial of service by sending crafted XML payloads that trigger an infinite loop in the Apache XercesJ parser, consuming system resources. - **Severity:** Medium 6.5 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H`) - **Exploited in the wild:** Not known - **Login needed:** Not needed - **Attackable:** Over the internet - **Victim action needed:** A user has to click or open something - **Fix available:** Yes - **Published:** 24 Jan 2022 - **Updated:** 8 Oct 2026 - **Also known as:** AZL-109499, CLEANSTART-2026-HR57844, CLSA-2026-1774398091, DEBIAN-CVE-2022-23437, GHSA-h65f-jvqw-m9fj, OESA-2022-1625, SUSE-SU-2022:0500-1, SUSE-SU-2022:0503-1, SUSE-SU-2022:0542-1, SUSE-SU-2022:14889-1, UBUNTU-CVE-2022-23437, openSUSE-SU-2022:0500-1, openSUSE-SU-2022:0503-1, openSUSE-SU-2024:11845-1 ## What is CVE-2022-23437? CVE-2022-23437 is a medium-severity denial of service vulnerability in Netapp Active Iq Unified Manager, published on 24 Jan 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link. ### Official description There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions. Weakness: CWE-835 (Loop with Unreachable Exit Condition) ## Which versions are affected by CVE-2022-23437? 2 open source packages ship an affected version, including xerces:xercesImpl. It affects 29 products. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `xerces:xercesImpl` | Maven | All versions | 2.12.2 | | `xerces:xercesImpl` | Maven | All versions | 2.12.2 | | `xerces-j2` | SUSE:Enterprise Storage 6 | All versions | 2.11.0-4.3.1 | | `xerces-j2` | SUSE:Enterprise Storage 7 | All versions | 2.12.0-3.3.1 | | `xerces-j2` | SUSE:HPE Helion OpenStack 8 | All versions | 2.8.1-268.9.1 | | `xerces-j2` | SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS | All versions | 2.11.0-4.3.1 | | `xerces-j2` | SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | All versions | 2.11.0-4.3.1 | | `xerces-j2` | SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS | All versions | 2.12.0-3.3.1 | | `xerces-j2` | SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 2.12.0-3.3.1 | | `xerces-j2` | SUSE:Linux Enterprise High Performance Computing 15-ESPOS | All versions | 2.11.0-4.3.1 | | `xerces-j2` | SUSE:Linux Enterprise High Performance Computing 15-LTSS | All versions | 2.11.0-4.3.1 | | `xerces-j2` | SUSE:Linux Enterprise Module for Basesystem 15 SP3 | All versions | 2.12.0-3.3.1 | | `xerces-j2` | SUSE:Linux Enterprise Point of Sale 11 SP3 | All versions | 2.8.1-238.29.8.1 | | `xerces-j2` | SUSE:Linux Enterprise Real Time 15 SP2 | All versions | 2.12.0-3.3.1 | | `xerces-j2` | SUSE:Linux Enterprise Server 11 SP4-LTSS | All versions | 2.8.1-238.29.8.1 | | `xerces-j2` | SUSE:Linux Enterprise Server 12 SP2-BCL | All versions | 2.8.1-268.9.1 | | `xerces-j2` | SUSE:Linux Enterprise Server 12 SP3-BCL | All versions | 2.8.1-268.9.1 | | `xerces-j2` | SUSE:Linux Enterprise Server 12 SP3-LTSS | All versions | 2.8.1-268.9.1 | | `xerces-j2` | SUSE:Linux Enterprise Server 12 SP4-LTSS | All versions | 2.8.1-268.9.1 | | `xerces-j2` | SUSE:Linux Enterprise Server 12 SP5 | All versions | 2.8.1-268.9.1 | | `xerces-j2` | SUSE:Linux Enterprise Server 15 SP1-BCL | All versions | 2.11.0-4.3.1 | | `xerces-j2` | SUSE:Linux Enterprise Server 15 SP1-LTSS | All versions | 2.11.0-4.3.1 | | `xerces-j2` | SUSE:Linux Enterprise Server 15 SP2-BCL | All versions | 2.12.0-3.3.1 | | `xerces-j2` | SUSE:Linux Enterprise Server 15 SP2-LTSS | All versions | 2.12.0-3.3.1 | | `xerces-j2` | SUSE:Linux Enterprise Server 15-LTSS | All versions | 2.11.0-4.3.1 | | `xerces-j2` | SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | All versions | 2.8.1-268.9.1 | | `xerces-j2` | SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | All versions | 2.8.1-268.9.1 | | `xerces-j2` | SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 2.8.1-268.9.1 | | `xerces-j2` | SUSE:Linux Enterprise Server for SAP Applications 15 | All versions | 2.11.0-4.3.1 | | `xerces-j2` | SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | All versions | 2.11.0-4.3.1 | | `xerces-j2` | SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | All versions | 2.12.0-3.3.1 | | `xerces-j2` | SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 2.8.1-268.9.1 | | `xerces-j2` | SUSE:Manager Proxy 4.1 | All versions | 2.12.0-3.3.1 | | `xerces-j2` | SUSE:Manager Retail Branch Server 4.1 | All versions | 2.12.0-3.3.1 | | `xerces-j2` | SUSE:Manager Server 4.1 | All versions | 2.12.0-3.3.1 | | `xerces-j2` | SUSE:OpenStack Cloud 8 | All versions | 2.8.1-268.9.1 | | `xerces-j2` | SUSE:OpenStack Cloud 9 | All versions | 2.8.1-268.9.1 | | `xerces-j2` | SUSE:OpenStack Cloud Crowbar 8 | All versions | 2.8.1-268.9.1 | | `xerces-j2` | SUSE:OpenStack Cloud Crowbar 9 | All versions | 2.8.1-268.9.1 | | `xerces-j2` | openSUSE:Leap 15.3 | All versions | 2.11.0-4.3.1 | Products: Apache Xerces-J, Netapp Active Iq Unified Manager, Oracle Agile Engineering Data Management, Oracle Agile Product Lifecycle Management, Oracle Banking Deposits and Lines of Credit Servicing, Oracle Banking Party Management, Oracle Communications Asap, Oracle Communications Element Manager, Oracle Communications Session Report Manager, Oracle Communications Session Route Manager, Oracle Financial Services Analytical Applications Infrastructure, Oracle Financial Services Behavior Detection Platform, Oracle Financial Services Crime and Compliance Management Studio, Oracle Financial Services Enterprise Case Management, Oracle Flexcube Universal Banking, Oracle Global Lifecycle Management Nextgen Oui Framework, Oracle Global Lifecycle Management Opatch, Oracle Health Sciences Information Manager, Oracle Ilearning, Oracle Peoplesoft Enterprise Peopletools and 9 more. ## How do I fix CVE-2022-23437? Upgrade xerces:xercesImpl to 2.12.2 or later. ## Is CVE-2022-23437 being exploited? There is no known exploitation of CVE-2022-23437 in the wild and no public exploit code. ## Other vulnerabilities in Netapp Active Iq Unified Manager - [CVE-2018-2799](https://insights.sbomify.com/CVE-2018-2799/): Denial of service in Java (medium 5.3) ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2022-23437 and fix it if it is affected. What it is: CVE-2022-23437 is a medium-severity denial of service vulnerability in Netapp Active Iq Unified Manager, published on 24 Jan 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link. Exploitation: There is no known exploitation of CVE-2022-23437 in the wild and no public exploit code. Affected packages and fixed versions: - xerces:xercesImpl (Maven): affected all versions; fixed in 2.12.2 - xerces:xercesImpl (Maven): affected all versions; fixed in 2.12.2 Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2022-23437/ (Markdown: https://insights.sbomify.com/CVE-2022-23437/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2022-23437 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2022-23437 - OSV: https://osv.dev/vulnerability/CVE-2022-23437 --- From sbomify Insights: https://insights.sbomify.com/CVE-2022-23437/ Summaries are generated and may contain mistakes; the official description above is the record.