vulnerability

Amazon Linux AMI 2: CVE-2022-23437: Security patch for xerces-j2 (Multiple Advisories)

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:M/Au:N/C:N/I:N/A:C)

Published

Jan 24, 2022

Added

May 13, 2025

Modified

May 20, 2026

Description

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.

Solutions

amazon-linux-ami-2-upgrade-xerces-j2amazon-linux-ami-2-upgrade-xerces-j2-demoamazon-linux-ami-2-upgrade-xerces-j2-javadoc

References

AMAZON-AL2/ALAS-2024-2649
CVE-2022-23437
https://attackerkb.com/topics/CVE-2022-23437
CWE-835
EUVD-EUVD-2022-0613
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-0613

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report