CVE-2022-34169

high Apache
CVSS v3 Base Score
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS Score
11.0%
Exploitation probability in 30 days
Top 6% most likely to be exploited
Attack Characteristics
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Confidentiality
None
Integrity
High
Availability
None
Published: July 19, 2022 (1452 days ago)
Last Modified: May 27, 2026
Vendor: Apache
Source: NVD

Description

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.

CWE

CWE-681

Affected Products

apache xalan-javadebian debian linuxoracle graalvmoracle jdkoracle jreoracle openjdkfedoraproject fedoranetapp 7-mode transition toolnetapp active iq unified managernetapp cloud insights acquisition unit

References

🔗 packetstormsecurity.com 🔗 www.openwall.com 🔗 www.openwall.com 🔗 www.openwall.com 🔗 www.openwall.com