CVE-2022-21299

What it actually does

The flaw in the JAXP component permits an unauthenticated network attacker to trigger a partial denial of service against the Java runtime used by affected products, impacting availability without requiring authentication or user interaction.

Why it matters to the business

Organizations running the affected product may experience intermittent service degradation or outages when the vulnerable Java component processes untrusted data, increasing operational overhead and potential revenue loss until the runtime is updated.

How an attack unfolds

An attacker sends crafted XML or related payloads over supported network protocols to the JAXP APIs exposed by the product; the malformed input causes excessive resource consumption in the Java sandbox or web-service layer, resulting in partial denial of service.

How to fix it

Upgrade the affected product to one of the listed fixed commits (661f7e4160fd380b54f36039b0e7f585b4cdb647 or d69f38d4a95eb664a8987247b61d8d1130c9f94a) or later; apply the corresponding product release that bundles an updated Java runtime addressing the JAXP issue.

How to confirm the fix worked

Confirm the product version reports one of the fixed commit hashes, verify that JAXP-related processing no longer exhibits the partial DoS behavior under test payloads, and monitor availability metrics post-deployment.

Typical attack path

1. Identify publicly reachable endpoints that invoke JAXP processing
2. Craft and transmit malicious XML or data structures via HTTP, web services, or other supported protocols
3. Trigger repeated processing of the payload to amplify resource exhaustion
4. Observe partial service degradation or unavailability on the target instance

How to detect it

Search application and web-server logs for repeated requests containing suspicious XML structures or JAXP-related stack traces coinciding with availability drops; correlate with Java process resource spikes or partial service failures.

What your security team should do

• Prioritize patching all internet-facing instances within the next maintenance window
• Review and restrict network exposure of any JAXP-dependent endpoints until upgraded
• Add the listed fixed commit hashes to vulnerability scanners and asset inventories
• Test application behavior with representative untrusted input after the update