PT-2022-3956 · Apache+12 · Apache Xalan Java Xslt Library+12

Felix Wilhelm · Published 2022-07-04 · Updated 2026-05-08 · CVE-2022-34169

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Apache Xalan Java XSLT library versions prior to 2.7.3

Description The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Note that Java runtimes, such as OpenJDK, include repackaged copies of Xalan.

Recommendations To resolve the issue, update to version 2.7.3 or later. As a temporary workaround, consider restricting the processing of malicious XSLT stylesheets until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-192

CWE-681

Related Identifiers

ALSA-2022:5683

ALSA-2022:5695

ALSA-2022:5696

ALSA-2022:5709

ALSA-2022:5736

ALT-PU-2022-7661

ALT-PU-2022-7662

ALT-PU-2022-7663

ALT-PU-2022-7664

ALT-PU-2022-7665

ALT-PU-2022-7666

ALT-PU-2022-7667

ALT-PU-2022-7668

ALT-PU-2024-16690

ALT-PU-2024-16795

ALT-PU-2024-17652

ALT-PU-2025-6317

BDU:2022-04788

BIT-JAVA-2022-34169

BIT-JAVA-MIN-2022-34169

BIT-JRE-2022-34169

CESA-2022_5683

CESA-2022_5687

CESA-2022_5696

CESA-2022_5698

CESA-2022_5726

CVE-2022-34169

DLA-3155-1

DSA-5188-1

DSA-5192-1

DSA-5256-1

GHSA-9339-86WC-4QGF

MGASA-2022-0435

OESA-2022-1786

OESA-2022-1832

OESA-2022-1849

OESA-2022-1977

OPENSUSE-SU-2022_2660-1

OPENSUSE-SU-2022_2707-1

OPENSUSE-SU-2022_2856-1

OPENSUSE-SU-2022_2949-1

OPENSUSE-SU-2022_3092-1

OPENSUSE-SU-2022_4166-1

OPENSUSE-SU-2024:12201-1

OPENSUSE-SU-2024:12202-1

OPENSUSE-SU-2024:12203-1

OPENSUSE-SU-2024:12207-1

OPENSUSE-SU-2024:12208-1

OPENSUSE-SU-2024:12234-1

OPENSUSE-SU-2024:12261-1

OPENSUSE-SU-2024:12263-1

OPENSUSE-SU-2024:13189-1

OPENSUSE-SU-2024:13440-1

OPENSUSE-SU-2024:14174-1

OPENSUSE-SU-2025:0066-1

OPENSUSE-SU-2025:14697-1

OPENSUSE-SU-2026:10356-1

RHSA-2022:5681

RHSA-2022:5683

RHSA-2022:5684

RHSA-2022:5685

RHSA-2022:5687

RHSA-2022:5695

RHSA-2022:5696

RHSA-2022:5697

RHSA-2022:5698

RHSA-2022:5700

RHSA-2022:5701

RHSA-2022:5709

RHSA-2022:5726

RHSA-2022:5736

RHSA-2022_5683

RHSA-2022_5687

RHSA-2022_5695

RHSA-2022_5696

RHSA-2022_5698

RHSA-2022_5709

RHSA-2022_5726

RHSA-2022_5736

RHSA-2024:10207

RHSA-2024:10208

RHSA-2024:8075

RHSA-2024:8076

RHSA-2024:8077

RHSA-2024:8823

RHSA-2024:8824

RLSA-2022:5683

RLSA-2022:5696

RLSA-2022:5726

ROSA-SA-2023-2138

SUSE-RU-2024:3971-1

SUSE-SU-2022:2610-1

SUSE-SU-2022:2660-1

SUSE-SU-2022:2707-1

SUSE-SU-2022:2819-1

SUSE-SU-2022:2856-1

SUSE-SU-2022:2898-1

SUSE-SU-2022:2899-1

SUSE-SU-2022:2949-1

SUSE-SU-2022:3092-1

SUSE-SU-2022:3152-1

SUSE-SU-2022:4166-1

USN-5546-1

USN-5546-2

Affected Products

Alt Linux

Almalinux

Apache Xalan Java Xslt Library

Astra Linux

Centos

Java Platform

Jira

Linuxmint

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

References · 405

• 🔥 https://github.com/flowerwind/AutoGenerateXalanPayload · Exploit
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2022:5709 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/705874 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:12207-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5546-2 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-5696.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21349 · Security Note
• https://linux.oracle.com/errata/ELSA-2022-5726.html · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jre-2022-34169 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/681986 · Security Note
• https://osv.dev/vulnerability/DSA-5188-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ · Vendor Advisory