{"action":"Upgrade org.apache.calcite:calcite-core to 1.32.0 or later.","affected":[{"fixed":"1.32.0","introduced":"1.22.0"}],"component":"org.apache.calcite:calcite-core","cve_ids":["CVE-2022-39135"],"ecosystem":"Maven","epss":0.02201,"exploited":false,"fixed_versions":["1.32.0"],"ghsa_id":"GHSA-fj2m-w3wv-x9pr","id":"tcs_01M5N8W3SWER2W8G43SHAD11R2","modified_at":"2026-09-29T21:30:09.149150258Z","published_at":"2022-09-12T00:00:34Z","references":["https://osv.dev/vulnerability/GHSA-fj2m-w3wv-x9pr","https://nvd.nist.gov/vuln/detail/CVE-2022-39135","https://github.com/apache/calcite/commit/1ddc1c3a0c61","https://github.com/apache/calcite/commit/ba80b9156afc0db26b194d97a031fcc0dc7f4c03","https://calcite.apache.org/news/2022/09/10/release-1.32.0","https://github.com/apache/calcite","https://github.com/apache/calcite/blob/calcite-1.22.0/core/src/main/java/org/apache/calcite/runtime/XmlFunctions.java","https://github.com/apache/calcite/blob/calcite-1.31.0/core/src/main/java/org/apache/calcite/runtime/XmlFunctions.java","https://github.com/apache/calcite/blob/calcite-1.32.0/core/src/main/java/org/apache/calcite/runtime/XmlFunctions.java","https://github.com/apache/calcite/tree/calcite-1.19.0/core/src/main/java/org/apache/calcite/runtime","https://issues.apache.org/jira/browse/CALCITE-5263","https://lists.apache.org/thread/ohdnhlgm6jvt3srw8l7spkm2d5vwm082","https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHECALCITE-3021143","http://www.openwall.com/lists/oss-security/2022/11/21/3"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-fj2m-w3wv-x9pr","url":"https://osv.dev/vulnerability/GHSA-fj2m-w3wv-x9pr"}],"summary":"Apache Calcite before 1.32.0 vulnerable to potential XML External Entity (XXE) attack"}