CVE-2022-39135

Maven/org.apache.calcite:calcite-core CVE-2022-39135: critical 9.8, EPSS 2.20%

Apache Calcite before 1.32.0 vulnerable to potential XML External Entity (XXE) attack

Action: Upgrade org.apache.calcite:calcite-core to 1.32.0 or later.

Affected

Fixed versions

Sources

• osv: GHSA-fj2m-w3wv-x9pr
• https://nvd.nist.gov/vuln/detail/CVE-2022-39135
• https://github.com/apache/calcite/commit/1ddc1c3a0c61
• https://github.com/apache/calcite/commit/ba80b9156afc0db26b194d97a031fcc0dc7f4c03
• https://calcite.apache.org/news/2022/09/10/release-1.32.0
• https://github.com/apache/calcite
• https://github.com/apache/calcite/blob/calcite-1.22.0/core/src/main/java/org/apache/calcite/runtime/XmlFunctions.java
• https://github.com/apache/calcite/blob/calcite-1.31.0/core/src/main/java/org/apache/calcite/runtime/XmlFunctions.java
• https://github.com/apache/calcite/blob/calcite-1.32.0/core/src/main/java/org/apache/calcite/runtime/XmlFunctions.java
• https://github.com/apache/calcite/tree/calcite-1.19.0/core/src/main/java/org/apache/calcite/runtime
• https://issues.apache.org/jira/browse/CALCITE-5263
• https://lists.apache.org/thread/ohdnhlgm6jvt3srw8l7spkm2d5vwm082
• https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHECALCITE-3021143
• http://www.openwall.com/lists/oss-security/2022/11/21/3

CVE-2022-39135 · published 2022-09-12T00:00:34Z · modified 2026-09-29T21:30:09.149150258Z · JSON