CVE-2022-23437

What it actually does

The Xerces-J XML parser enters an infinite loop when processing specially crafted XML document payloads, consuming CPU and system resources for an extended period without termination.

Why it matters to the business

Attackers can trigger denial-of-service conditions against any application using the vulnerable parser, causing service disruption or resource exhaustion across a wide range of Oracle and Apache-dependent products with many downstream dependents.

How an attack unfolds

An attacker crafts a malicious XML payload that triggers the parser's infinite loop condition and delivers it over the network to any endpoint that invokes Xerces-J XML parsing; the stable moderate EPSS indicates limited observed exploitation activity despite the long public disclosure period.

How to fix it

Upgrade Apache Xerces-J beyond version 2.12.1 when a fixed release becomes available; apply the latest vendor-supplied patches for all listed Oracle products that embed the vulnerable parser.

How to confirm the fix worked

Reproduce the issue with known malicious XML test cases before and after patching, confirm parser termination within expected time bounds, and verify product version numbers against vendor fixed releases.

Typical attack path

1. Locate a network-accessible target that uses the vulnerable Xerces-J parser
2. Craft an XML document containing the specific structure that induces the infinite loop
3. Transmit the payload in a request that triggers XML parsing (e.g., via HTTP or other input channels)
4. Observe sustained high CPU or memory consumption on the target system

How to detect it

Monitor application and system logs for XML parsing operations on untrusted input, correlate with spikes in CPU or thread utilization, and review request logs for unusually large or malformed XML payloads.

What your security team should do

• Inventory all systems and applications using Xerces-J 2.12.1 or earlier
• Apply available vendor patches with priority proportional to exposure and EPSS score
• Implement XML input validation or schema enforcement at application boundaries
• Monitor for changes in EPSS trend or exploit maturity