CVE-2022-21426: Medium severity Oracle GraalVM vulnerability

Q: What is CVE-2022-21426?

CVE-2022-21426 is an unspecified vulnerability in Java SE related to the JAXP component that could allow an unauthenticated attacker to exploit it.

Q: What is the severity of CVE-2022-21426?

The severity of CVE-2022-21426 is medium with a CVSS score of 5.3.

Q: Which versions of Oracle Java SE are affected by CVE-2022-21426?

Oracle Java SE versions 7u331, 8u321, 11.0.14, 17.0.2, 18 are affected by CVE-2022-21426.

Q: Which versions of Oracle GraalVM Enterprise Edition are affected by CVE-2022-21426?

Oracle GraalVM Enterprise Edition versions 20.3.5, 21.3.1, and 22.0.0.2 are affected by CVE-2022-21426.

Q: How can I fix CVE-2022-21426?

To fix CVE-2022-21426, update your Oracle Java SE installations to the patched versions provided by Oracle.

Published Apr 15, 2022

Updated

An unspecified vulnerability in Java SE related to the JAXP component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.

Other sources

It was discovered that the XPath class in the JAXP component in OpenJDK failed to sufficiently limit the amount of memory allocated when compiling a specially crafted XPath expression. This could possibly cause a Java application to exit because of an out of memory (OOM) error if it processed untrusted XPath expressions.

Three new XML processing limits are introduced to the XML libraries as part of the fix:

- jdk.xml.xpathExprGrpLimit limits the number of groups an XPath expression can contain. - jdk.xml.xpathExprOpLimit limits the number of operators an XPath expression can contain. - jdk.xml.xpathTotalOpLimit limits the total number of XPath operators in an XSL Stylesheet.

See the following release notes for Oracle JDK 7u341, 8u331, 11.0.15, 17.0.3, 18.0.1:

https://www.oracle.com/java/technologies/javase/7-support-relnotes.html#JDK-8270504 https://www.oracle.com/java/technologies/javase/8u331-relnotes.html#JDK-8270504 https://www.oracle.com/java/technologies/javase/11-0-15-relnotes.html#JDK-8270504 https://www.oracle.com/java/technologies/javase/17-0-3-relnotes.html#JDK-8270504 https://www.oracle.com/java/technologies/javase/18-0-1-relnotes.html#JDK-8270504

— Red Hat

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Affected Software

56 affected componentsFixes available

redhat/java<11-openjdk-1:11.0.15.0.9-2.el7_9

11-openjdk-1:11.0.15.0.9-2.el7_9

redhat/java<1.8.0-openjdk-1:1.8.0.332.b09-1.el7_9

1.8.0-openjdk-1:1.8.0.332.b09-1.el7_9

redhat/java<1.8.0-ibm-1:1.8.0.8.0-1jpp.1.el7

1.8.0-ibm-1:1.8.0.8.0-1jpp.1.el7

redhat/java<11-openjdk-1:11.0.15.0.9-2.el8_5

11-openjdk-1:11.0.15.0.9-2.el8_5

redhat/java<17-openjdk-1:17.0.3.0.6-2.el8_5

17-openjdk-1:17.0.3.0.6-2.el8_5

redhat/java<1.8.0-openjdk-1:1.8.0.332.b09-1.el8_5

1.8.0-openjdk-1:1.8.0.332.b09-1.el8_5

redhat/java<11-openjdk-1:11.0.15.0.9-2.el8_1

11-openjdk-1:11.0.15.0.9-2.el8_1

redhat/java<1.8.0-openjdk-1:1.8.0.332.b09-1.el8_1

1.8.0-openjdk-1:1.8.0.332.b09-1.el8_1

redhat/java<11-openjdk-1:11.0.15.0.9-2.el8_2

11-openjdk-1:11.0.15.0.9-2.el8_2

redhat/java<1.8.0-openjdk-1:1.8.0.332.b09-1.el8_2

1.8.0-openjdk-1:1.8.0.332.b09-1.el8_2

redhat/java<11-openjdk-1:11.0.15.0.9-2.el8_4

11-openjdk-1:11.0.15.0.9-2.el8_4

redhat/java<1.8.0-openjdk-1:1.8.0.332.b09-1.el8_4

1.8.0-openjdk-1:1.8.0.332.b09-1.el8_4

redhat/java<11-openjdk-1:11.0.15.0.10-1.el9_0

11-openjdk-1:11.0.15.0.10-1.el9_0

redhat/java<17-openjdk-1:17.0.3.0.7-1.el9_0

17-openjdk-1:17.0.3.0.7-1.el9_0

redhat/java<1.8.0-openjdk-1:1.8.0.332.b09-1.el9_0

1.8.0-openjdk-1:1.8.0.332.b09-1.el9_0

debian/openjdk-11

11.0.16+8-1~deb10u111.0.20+8-1~deb10u111.0.20+8-1~deb11u111.0.21+9-1

debian/openjdk-17

17.0.7+7-1~deb11u117.0.8+7-1~deb12u117.0.9+9-1

debian/openjdk-8

8u382-ga-2

Oracle GraalVM=20.3.5

Oracle GraalVM=21.3.1

Oracle GraalVM=22.0.0.2

Oracle JDK=1.7.0-update331

Oracle JDK=1.8.0-update321

Oracle JDK=11.0.14

Oracle JDK=17.0.2

Oracle JDK=18

Oracle JRE=1.7.0-update331

Oracle JRE=1.8.0-update321

Oracle JRE=11.0.14

Oracle JRE=17.0.2

Oracle JRE=18

Debian Debian Linux=9.0

Debian Debian Linux=10.0

Debian Debian Linux=11.0

NetApp 7-Mode Transition Tool

NetApp Active Iq Unified Manager Vsphere

NetApp Active Iq Unified Manager Windows

NetApp Cloud Insights Acquisition Unit

NetApp Cloud Secure Agent

NetApp E-Series SANtricity OS Controller>=11.0.0<=11.70.1

NetApp E-series Santricity Storage Manager

NetApp E-series Santricity Web Services Web Services Proxy

NetApp OnCommand Insight

NetApp Santricity Unified Manager

NetApp Solidfire\, Enterprise Sds \& Hci Storage Node

NetApp Solidfire \& Hci Management Node

NetApp Hci Compute Node Firmware

Azul Zulu=6.45

Azul Zulu=7.52

Azul Zulu=8.60

Azul Zulu=11.54

Azul Zulu=13.46

Azul Zulu=15.38

Azul Zulu=17.32

Azul Zulu=18.28

IBM DB2 Recovery Expert for LUW<=5.5 IF 2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/java to a version that resolves this vulnerability.
Fixed in 11-openjdk-1:11.0.15.0.9-2.el7_9
Upgrade
Upgrade redhat/java to a version that resolves this vulnerability.
Fixed in 1.8.0-openjdk-1:1.8.0.332.b09-1.el7_9
Upgrade
Upgrade redhat/java to a version that resolves this vulnerability.
Fixed in 1.8.0-ibm-1:1.8.0.8.0-1jpp.1.el7
Upgrade
Upgrade redhat/java to a version that resolves this vulnerability.
Fixed in 11-openjdk-1:11.0.15.0.9-2.el8_5
Upgrade
Upgrade redhat/java to a version that resolves this vulnerability.
Fixed in 17-openjdk-1:17.0.3.0.6-2.el8_5
Upgrade
Upgrade redhat/java to a version that resolves this vulnerability.
Fixed in 1.8.0-openjdk-1:1.8.0.332.b09-1.el8_5
Upgrade
Upgrade redhat/java to a version that resolves this vulnerability.
Fixed in 11-openjdk-1:11.0.15.0.9-2.el8_1
Upgrade
Upgrade redhat/java to a version that resolves this vulnerability.
Fixed in 1.8.0-openjdk-1:1.8.0.332.b09-1.el8_1
Upgrade
Upgrade redhat/java to a version that resolves this vulnerability.
Fixed in 11-openjdk-1:11.0.15.0.9-2.el8_2
Upgrade
Upgrade redhat/java to a version that resolves this vulnerability.
Fixed in 1.8.0-openjdk-1:1.8.0.332.b09-1.el8_2
Upgrade
Upgrade redhat/java to a version that resolves this vulnerability.
Fixed in 11-openjdk-1:11.0.15.0.9-2.el8_4
Upgrade
Upgrade redhat/java to a version that resolves this vulnerability.
Fixed in 1.8.0-openjdk-1:1.8.0.332.b09-1.el8_4
Upgrade
Upgrade redhat/java to a version that resolves this vulnerability.
Fixed in 11-openjdk-1:11.0.15.0.10-1.el9_0
Upgrade
Upgrade redhat/java to a version that resolves this vulnerability.
Fixed in 17-openjdk-1:17.0.3.0.7-1.el9_0
Upgrade
Upgrade redhat/java to a version that resolves this vulnerability.
Fixed in 1.8.0-openjdk-1:1.8.0.332.b09-1.el9_0
Upgrade
Upgrade debian/openjdk-11 to a version that resolves this vulnerability.
Fixed in 11.0.16+8-1~deb10u1Fixed in 11.0.20+8-1~deb10u1Fixed in 11.0.20+8-1~deb11u1Fixed in 11.0.21+9-1
Upgrade
Upgrade debian/openjdk-17 to a version that resolves this vulnerability.
Fixed in 17.0.7+7-1~deb11u1Fixed in 17.0.8+7-1~deb12u1Fixed in 17.0.9+9-1
Upgrade
Upgrade debian/openjdk-8 to a version that resolves this vulnerability.
Fixed in 8u382-ga-2
Configuration
Configure the JAXP XPath processing limit property jdk.xml.xpathExprGrpLimit to constrain XPath complexity and reduce memory consumption when compiling XPath expressions.
JAXP (XPath) jdk.xml.xpathExprGrpLimit = Set to a value that limits the number of groups an XPath expression can contain (introduced as part of the fix).
Configuration
Configure the JAXP XPath processing limit property jdk.xml.xpathExprOpLimit to constrain XPath complexity and reduce memory consumption when compiling XPath expressions.
JAXP (XPath) jdk.xml.xpathExprOpLimit = Set to a value that limits the number of operators an XPath expression can contain (introduced as part of the fix).
Configuration
Configure the JAXP XPath processing limit property jdk.xml.xpathTotalOpLimit to constrain XPath complexity in XSL stylesheets and reduce memory consumption when compiling XPath expressions.
JAXP (XPath) jdk.xml.xpathTotalOpLimit = Set to a value that limits the total number of XPath operators in an XSL stylesheet (introduced as part of the fix).

Event History

Apr 15, 2022

Data Sourced

via Red Hat·10:50 AM

DescriptionSeverityAffected Software

Apr 19, 2022

CVE Published

08:00 PM

CVE Published

via MITRE·08:37 PM

Data Sourced

via MITRE·08:37 PM

DescriptionSeverityWeakness

Feb 5, 2026

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is CVE-2022-21426?

CVE-2022-21426 is an unspecified vulnerability in Java SE related to the JAXP component that could allow an unauthenticated attacker to exploit it.

What is the severity of CVE-2022-21426?

The severity of CVE-2022-21426 is medium with a CVSS score of 5.3.

Which versions of Oracle Java SE are affected by CVE-2022-21426?

Oracle Java SE versions 7u331, 8u321, 11.0.14, 17.0.2, 18 are affected by CVE-2022-21426.

Which versions of Oracle GraalVM Enterprise Edition are affected by CVE-2022-21426?

Oracle GraalVM Enterprise Edition versions 20.3.5, 21.3.1, and 22.0.0.2 are affected by CVE-2022-21426.

How can I fix CVE-2022-21426?

To fix CVE-2022-21426, update your Oracle Java SE installations to the patched versions provided by Oracle.

CVE-2022-21426: Medium severity Oracle GraalVM vulnerability

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

What is CVE-2022-21426?

What is the severity of CVE-2022-21426?

Which versions of Oracle Java SE are affected by CVE-2022-21426?

Which versions of Oracle GraalVM Enterprise Edition are affected by CVE-2022-21426?

How can I fix CVE-2022-21426?

Company

Resources

Contact