CVE-2022-34169 OpenJDK
| Affected software | OpenJDK |
|---|---|
| Severity | 7.5 High CVSS 3.1 2 scores |
| Fixed in | 2.7.3 |
| Weakness | CWE-681 |
| Published | 19 Jul 2022 |
| Updated | 17 Jun 2026 |
Description
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.
Exploitation status
Proof of concept only
A proof of concept exists, but no reviewed exploit catalogue lists this CVE.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment exploitation: none
- Indexed PoC 3 indexed Published artifacts you can open, in GitHub PoC; first seen 2022-08-15.
- EPSS 82% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.7% of all scored CVEs.
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | cve-2022-34169 延伸出的Jdk Xalan的payload自动生成工具，可根据不同的Jdk生成出其所对应的xslt文件 | 94 | 2023-01-17 |
| GitHub PoC | A PoC for CVE-2022-34169, for the SU_PWN challenge from SUCTF 2025 | 3 | 2025-01-17 |
| GitHub PoC | https://nvd.nist.gov/vuln/detail/CVE-2022-34169 | 2022-08-15 |
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full
- Action available patch rule
- Review human ARMR file
- Record active
| Decided by | An ARMR patch file on disk for this CVE |
|---|---|
| Finding | CVE has an ARMR patch rule that provides mitigation |
ARMR rule files
1 fileThe rule files Waratek ships for this CVE. Some CVEs need more than one, for example one per affected library or one per ARMR version.
CVE-2022-34169.armr patch rule, ARMR 2.6 added 2022-08-17 updated 2026-03-04How to mitigate CVE-2022-34169
Upgrade OpenJDK to 2.7.3 or later. Until you can, Waratek RASP blocks exploitation with a rule written for this CVE. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
7.5 HIGH
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
2 metrics
CVSS
7.5 HIGH v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
NVD | Primary | published |
| CVSS 3.1 | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
CISA-ADP | Secondary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update October 2026 ↗ | CPU | 2026-Q4 | Oracle Supply Chain / Installation Issues (Apache Xalan-Java) (3.6.1) |
| Oracle Critical Security Patch Update August 2026 ↗ | CSPU | 2026-Q3 | Oracle Hyperion / Common Security (Apache Xalan-Java) (11.2.25.0.000) |
| Oracle Critical Patch Update July 2025 ↗ | CPU | 2025-Q3 | Oracle Retail Applications / Mathematical Operators (Apache Xalan-Java) (13.2.5) Oracle Supply Chain / Core (Apache Xalan-Java) (21.0.2, 21.1.0) Oracle's note: This vulnerability applies to Oracle AutoVue Office, Oracle AutoVue 2D Professional, Oracle AutoVue 3D Professional Advanced, Oracle AutoVue EDA Professional and Oracle AutoVue Electro-Mechanical Professional. Please refer to Patch Availability Document for more details. Oracle Supply Chain / Core (Apache Xalan-Java) (3.6.1) |
| Oracle Critical Patch Update January 2025 ↗ | CPU | 2025-Q1 | Oracle Financial Services Applications / Reports (Apache Xalan-Java) (8.1.2.5) |
| Oracle Critical Patch Update July 2024 ↗ | CPU | 2024-Q3 | Oracle Commerce / Workbench, Content Acquisition System, Platform Services (Apache Xalan-Java) (11.3.2) Oracle Communications / CMP (Apache Xalan-Java) (12.6.1.0.0, 15.0.0.0.0) Oracle Communications / Security (Apache Xalan-Java) (46.6.4, 46.6.5) Oracle Insurance Applications / Architecture (Apache Xalan-Java) (11.2.11, 11.3.0-11.3.2) Oracle Insurance Applications / Development Tools (Apache Xalan-Java) (12.6.4, 12.7.1) Oracle Siebel CRM / Server Infrastructure (Apache Xalan-Java) (22.12 and prior) Oracle Supply Chain / Core (Apache Xalan-Java) (6.2.1.0-6.2.1.7) Oracle Supply Chain / Installation (Apache Xalan-Java) (21.0.2) |
| Oracle Critical Patch Update April 2024 ↗ | CPU | 2024-Q2 | Oracle Communications Applications / General (Apache Xalan-Java) (7.4.0-7.4.2, 7.5.0, 7.5.1) Oracle Fusion Middleware / Outside In Clean Content SDK (Apache Xalan-Java) (8.5.6, 8.5.7) Oracle Supply Chain / Install (Apache Xalan-Java) (6.5.2) |
| Oracle Critical Patch Update January 2024 ↗ | CPU | 2024-Q1 | Oracle Financial Services Applications / Web UI (Oracle Java SE) (8.0.8.2, 8.1.1.1, 8.1.2.5, 8.1.2.6) |
| Oracle Critical Patch Update April 2023 ↗ | CPU | 2023-Q2 | Oracle Analytics / JAXP (Apache Xalan-J) (12.2.1.4.0) Oracle Financial Services Applications / Infrastructure (Apache Xalan-Java) (2.7, 2.7.1, 2.8, 2.9, 2.9.1, 3.0, 3.1, 3.2, 4.0) Oracle PeopleSoft / Integration Broker (Apache Xalan-Java) (8.58) |
| Oracle Critical Patch Update January 2023 ↗ | CPU | 2023-Q1 | Oracle Supply Chain / Application Server (Apache Xalan-J) (9.3.6) |
| Oracle Critical Patch Update July 2022 ↗ | CPU | 2022-Q3 | Oracle Java SE / JAXP (Xalan-J) (Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2, 22.1.0) Oracle's note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Analytics | JAXP (Apache Xalan-J) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle Commerce | Workbench, Content Acquisition System, Platform Services (Apache Xalan-Java) | 11.3.2 | 11.3.2 |
| Oracle Communications | CMP (Apache Xalan-Java) | 12.6.1.0.0, 15.0.0.0.0 | 12.6.1.0.0 · 15.0.0.0.0 |
| Oracle Communications | Security (Apache Xalan-Java) | 46.6.4, 46.6.5 | 46.6.4 · 46.6.5 |
| Oracle Communications Applications | General (Apache Xalan-Java) | 7.4.0-7.4.2, 7.5.0, 7.5.1 | 7.5.0 · 7.5.1 |
| Oracle Financial Services Applications | Infrastructure (Apache Xalan-Java) | 2.7, 2.7.1, 2.8, 2.9, 2.9.1, 3.0, 3.1, 3.2, 4.0 | 2.7 · 2.7.1 · 2.8 · 2.9 · 2.9.1 · 3.0 · 3.1 · 3.2 · 4.0 |
| Oracle Financial Services Applications | Reports (Apache Xalan-Java) | 8.1.2.5 | 8.1.2.5 |
| Oracle Financial Services Applications | Web UI (Oracle Java SE) | 8.0.8.2, 8.1.1.1, 8.1.2.5, 8.1.2.6 | 8.0.8.2 · 8.1.1.1 · 8.1.2.5 · 8.1.2.6 |
| Oracle Fusion Middleware | Outside In Clean Content SDK (Apache Xalan-Java) | 8.5.6, 8.5.7 | 8.5.6 · 8.5.7 |
| Oracle Hyperion | Common Security (Apache Xalan-Java) | 11.2.25.0.000 | 11.2.25.0.0 |
| Oracle Insurance Applications | Architecture (Apache Xalan-Java) | 11.2.11, 11.3.0-11.3.2 | 11.2.11 |
| Oracle Insurance Applications | Development Tools (Apache Xalan-Java) | 12.6.4, 12.7.1 | 12.6.4 · 12.7.1 |
| Oracle Java SE | JAXP (Xalan-J) | Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2, 22.1.0 | 7.0.343.0 · 8.0.333.0 · 11.0.15.0 · 17.0.3.0 · 18.0.1.0 · 20.3.6.0 · 21.3.2.0 · 22.1.0.0 |
| Oracle PeopleSoft | Integration Broker (Apache Xalan-Java) | 8.58 | 8.58 |
| Oracle Retail Applications | Mathematical Operators (Apache Xalan-Java) | 13.2.5 | 13.2.5 |
| Oracle Siebel CRM | Server Infrastructure (Apache Xalan-Java) | 22.12 and prior | |
| Oracle Supply Chain | Application Server (Apache Xalan-J) | 9.3.6 | 9.3.6 |
| Oracle Supply Chain | Core (Apache Xalan-Java) | 6.2.1.0-6.2.1.7 | 3.6.1 · 21.0.2 · 21.1.0 |
| Oracle Supply Chain | Install (Apache Xalan-Java) | 6.5.2 | 6.5.2 |
| Oracle Supply Chain | Installation (Apache Xalan-Java) | 21.0.2 | 21.0.2 |
| Oracle Supply Chain | Installation Issues (Apache Xalan-Java) | 3.6.1 | 3.6.1 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
xalan:xalan |
0 | 2.7.3 |
unbounded |
Products and versions
17 products, 159 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | xalan-java | generic | ≤ 2.7.2 |
| nvd | azul | zulu | generic | 6.47 · 7.54 · 8.62 · 11.56 · 13.48 · 15.40 · 17.34 · 18.30 |
| nvd | debian | debian linux | generic | 10.0 · 11.0 |
| nvd | fedoraproject | fedora | generic | 35 · 36 |
| nvd | netapp | 7-mode transition tool | generic | any version |
| nvd | netapp | active iq unified manager | generic | any version |
| nvd | netapp | cloud insights acquisition unit | generic | any version |
| nvd | netapp | cloud secure agent | generic | any version |
| nvd | netapp | hci compute node | generic | any version |
| nvd | netapp | hci management node | generic | any version |
| nvd | netapp | oncommand insight | generic | any version |
| nvd | netapp | solidfire | generic | any version |
| nvd | oracle | graalvm | javase | 20.3.6 · 21.3.2 · 22.1.0 |
| nvd | oracle | jdk | javase | 1.7.0:update343 · 1.8.0:update333 · 11.0.15.1 · 17.0.3.1 · 18.0.1.1 |
| nvd | oracle | jre | javase | 1.7.0:update343 · 1.8.0:update333 · 11.0.15.1 · 17.0.3.1 · 18.0.1.1 |
| nvd | oracle | openjdk | javase | 7 · 7:update1 · 7:update2 · 7:update3 · 7:update4 · 7:update5 · 7:update6 · 7:update7 · 7:update9 · 7:update10 · 7:update11 · 7:update13 · 7:update15 · 7:update17 · 7:update21 · 7:update25 · 7:update40 · 7:update45 · 7:update51 · 7:update55 · 7:update60 · 7:update65 · 7:update67 · 7:update72 · 7:update76 · 7:update80 · 7:update85 · 7:update91 · 7:update95 · 7:update97 · 7:update99 · 7:update101 · 7:update111 · 7:update121 · 7:update131 · 7:update141 · 7:update151 · 7:update161 · 7:update171 · 7:update181 · 7:update191 · 7:update201 · 7:update211 · 7:update221 · 7:update231 · 7:update241 · 7:update251 · 7:update261 · 7:update271 · 7:update281 · 7:update291 · 7:update301 · 7:update311 · 7:update321 · 8 · 8:milestone1 · 8:milestone2 · 8:milestone3 · 8:milestone4 · 8:milestone5 · 8:update5 · 8:milestone6 · 8:milestone7 · 8:milestone8 · 8:milestone9 · 8:update11 · 8:update20 · 8:update25 · 8:update31 · 8:update40 · 8:update45 · 8:update51 · 8:update60 · 8:update65 · 8:update66 · 8:update71 · 8:update72 · 8:update73 · 8:update74 · 8:update77 · 8:update91 · 8:update92 · 8:update101 · 8:update102 · 8:update111 · 8:update112 · 8:update121 · 8:update131 · 8:update141 · 8:update151 · 8:update152 · 8:update161 · 8:update162 · 8:update171 · 8:update172 · 8:update181 · 8:update191 · 8:update192 · 8:update201 · 8:update202 · 8:update211 · 8:update212 · 8:update221 · 8:update222 · 8:update231 · 8:update232 · 8:update241 · 8:update242 · 8:update252 · 8:update262 · 8:update271 · 8:update281 · 8:update282 · 8:update291 · 8:update301 · 8:update302 · 8:update312 · 8:update322 · 8:update332 · ≥ 11.0.0.0 and ≤ 11.0.15.0 · ≥ 13.0.0.0 and ≤ 13.0.11.0 · ≥ 15.0.0.0 and ≤ 15.0.7.0 · ≥ 17.0.0.0 and ≤ 17.0.3.0 · 18 |
| osv | xalan | xalan | generic | ＜ 2.7.3 |
References
| URL | Tags |
|---|---|
| https://access.redhat.com/errata/RHSA-2022:5681 | ADVISORY, RHSA-2022:5681 |
| https://access.redhat.com/security/cve/CVE-2022-34169 | REPORT, RHSA-2022:5681 |
| https://access.redhat.com/errata/RHSA-2022:5683 | ADVISORY, RHSA-2022:5683 |
| https://access.redhat.com/errata/RHSA-2022:5684 | ADVISORY, RHSA-2022:5684 |
| https://access.redhat.com/errata/RHSA-2022:5685 | ADVISORY, RHSA-2022:5685 |
| https://access.redhat.com/errata/RHSA-2022:5687 | ADVISORY, RHSA-2022:5687 |
| https://access.redhat.com/errata/RHSA-2022:5695 | ADVISORY, RHSA-2022:5695 |
| https://access.redhat.com/errata/RHSA-2022:5696 | ADVISORY, RHSA-2022:5696 |
| https://access.redhat.com/errata/RHSA-2022:5697 | ADVISORY, RHSA-2022:5697 |
| https://access.redhat.com/errata/RHSA-2022:5698 | ADVISORY, RHSA-2022:5698 |
Timeline
Timeline
| Published | 2022-07-19 | By the CVE Program. |
|---|---|---|
| ARMR remediation created | 2022-08-17 | Earliest commit adding this CVE's ARMR patch or security rule. |
| ARMR remediation last updated | 2026-03-04 | Most recent commit touching this CVE's ARMR patch or security rule. |
| Last VRT activity | 2026-03-04 | Most recent commit touching this CVE's classification, patch or rule file. |
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |