Medium
libxerces2-java — security advisory
There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.
- Products
- libxerces2-java
- Affected versions
- 2.11.0-7, 2.11.0-8, 2.12.0-1, 2.12.1-1, 2.12.2-1
- Fixed versions
- Not specified
- CVEs
- CVE-2022-23437
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 01:00 UTC · Revision 1
Source evidence
There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.
osv:UBUNTU-CVE-2022-23437
libxerces2-java
Fixed versions: Not specified
libxerces2-java
Fixed versions: Not specified
libxerces2-java
Fixed versions: Not specified
libxerces2-java
Fixed versions: Not specified
libxerces2-java
Fixed versions: Not specified
libxerces2-java
Fixed versions: Not specified
libxerces2-java
Fixed versions: Not specified
libxerces2-java
Fixed versions: Not specified
libxerces2-java
Fixed versions: Not specified
Complete source record
{
"id": "0cbe0279ba737e68c44a1e82e96bbc80a32dd147a21919366c62ac31d22069fb",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-23437",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2022-23437",
"summary": "There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.",
"evidence": "osv:UBUNTU-CVE-2022-23437",
"products": [
{
"name": {
"value": "libxerces2-java",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.11.0-7",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "libxerces2-java",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.11.0-7",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "libxerces2-java",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.11.0-8",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "libxerces2-java",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.12.0-1",
"evidence": "/affected/3/versions"
},
{
"value": "2.12.1-1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "libxerces2-java",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.12.1-1",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "libxerces2-java",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.12.2-1",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "libxerces2-java",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.12.2-1",
"evidence": "/affected/6/versions"
}
]
},
{
"name": {
"value": "libxerces2-java",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.12.2-1",
"evidence": "/affected/7/versions"
}
]
},
{
"name": {
"value": "libxerces2-java",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.12.2-1",
"evidence": "/affected/8/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "UBUNTU-CVE-2022-23437",
"aliases": [
"UBUNTU-CVE-2022-23437"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libxerces2-java",
"purl": "pkg:deb/ubuntu/libxerces2-java?arch=source&distro=trusty",
"ecosystem": "Ubuntu:14.04:LTS"
},
"versions": [
"2.11.0-7"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-23437.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libxerces2-java",
"binary_version": "2.11.0-7"
},
{
"binary_name": "libxerces2-java-gcj",
"binary_version": "2.11.0-7"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libxerces2-java",
"purl": "pkg:deb/ubuntu/libxerces2-java?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"2.11.0-7"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-23437.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libxerces2-java",
"binary_version": "2.11.0-7"
},
{
"binary_name": "libxerces2-java-gcj",
"binary_version": "2.11.0-7"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libxerces2-java",
"purl": "pkg:deb/ubuntu/libxerces2-java?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"2.11.0-8"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-23437.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libxerces2-java",
"binary_version": "2.11.0-8"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libxerces2-java",
"purl": "pkg:deb/ubuntu/libxerces2-java?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"2.12.0-1",
"2.12.1-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-23437.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libxerces2-java",
"binary_version": "2.12.1-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libxerces2-java",
"purl": "pkg:deb/ubuntu/libxerces2-java?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"2.12.1-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-23437.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libxerces2-java",
"binary_version": "2.12.1-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libxerces2-java",
"purl": "pkg:deb/ubuntu/libxerces2-java?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"2.12.2-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-23437.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libxerces2-java",
"binary_version": "2.12.2-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libxerces2-java",
"purl": "pkg:deb/ubuntu/libxerces2-java?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"2.12.2-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-23437.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libxerces2-java",
"binary_version": "2.12.2-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libxerces2-java",
"purl": "pkg:deb/ubuntu/libxerces2-java?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"2.12.2-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-23437.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libxerces2-java",
"binary_version": "2.12.2-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libxerces2-java",
"purl": "pkg:deb/ubuntu/libxerces2-java?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"2.12.2-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-23437.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libxerces2-java",
"binary_version": "2.12.2-1"
}
]
}
}
],
"modified": "2026-10-17T12:56:20.810305771Z",
"provider": "osv",
"upstream": [
"CVE-2022-23437"
],
"references": [
"https://ubuntu.com/security/CVE-2022-23437",
"https://www.openwall.com/lists/oss-security/2022/01/24/3",
"https://lists.apache.org/thread/6pjwm10bb69kq955fzr1n0nflnjd27dl",
"https://www.cve.org/CVERecord?id=CVE-2022-23437"
]
},
"related_cves": [
{
"value": "CVE-2022-23437",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 355360,
"published_at": "2022-01-24T15:15:00+00:00"
}