CVE-2022-34169

Deeper analysis

The Apache Xalan Java XSLT library is affected by an integer truncation vulnerability (CWE-681) that occurs during processing of malicious XSLT stylesheets. The flaw resides in the internal XSLTC compiler and allows corruption of generated Java class files, ultimately enabling execution of arbitrary Java bytecode. The issue impacts Xalan-J versions prior to 2.7.3; because many Java runtimes, including OpenJDK, bundle repackaged copies of the library, the exposure extends beyond direct Xalan deployments. The vulnerability carries a CVSS 3.1 score of 7.5 with network attack vector and no required privileges or user interaction.

An unauthenticated remote attacker can supply a crafted XSLT stylesheet to any application that invokes the vulnerable Xalan processor, such as XML transformation services or document-processing pipelines. Successful exploitation results in high-integrity impact through execution of attacker-controlled bytecode while leaving confidentiality and availability unaffected.

Advisories published on the oss-security mailing list and the associated Packet Storm entry recommend immediate upgrade to Xalan-J 2.7.3 or later. Because the library is frequently embedded inside Java runtimes, operators are advised to apply vendor-supplied runtime updates that incorporate the patched Xalan classes.

Public proof-of-concept material has been available since disclosure, and the EPSS score has remained near 0.11 with only minor fluctuation between its recorded peak and current value.