It was discovered that the XPath class in the JAXP component in OpenJDK failed to sufficiently limit the amount of memory allocated when compiling a specially crafted XPath expression. This could possibly cause a Java application to exit because of an out of memory (OOM) error if it processed untrusted XPath expressions. Three new XML processing limits are introduced to the XML libraries as part of the fix: - jdk.xml.xpathExprGrpLimit limits the number of groups an XPath expression can contain. - jdk.xml.xpathExprOpLimit limits the number of operators an XPath expression can contain. - jdk.xml.xpathTotalOpLimit limits the total number of XPath operators in an XSL Stylesheet. See the following release notes for Oracle JDK 7u341, 8u331, 11.0.15, 17.0.3, 18.0.1: https://www.oracle.com/java/technologies/javase/7-support-relnotes.html#JDK-8270504 https://www.oracle.com/java/technologies/javase/8u331-relnotes.html#JDK-8270504 https://www.oracle.com/java/technologies/javase/11-0-15-relnotes.html#JDK-8270504 https://www.oracle.com/java/technologies/javase/17-0-3-relnotes.html#JDK-8270504 https://www.oracle.com/java/technologies/javase/18-0-1-relnotes.html#JDK-8270504
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Extended Update Support Via RHSA-2022:1443 https://access.redhat.com/errata/RHSA-2022:1443
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions Via RHSA-2022:1444 https://access.redhat.com/errata/RHSA-2022:1444
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Extended Update Support Via RHSA-2022:1441 https://access.redhat.com/errata/RHSA-2022:1441
OpenJDK-17 upstream commit: https://github.com/openjdk/jdk17u/commit/38b7732c204a41a8ac70b5ab222a9a4873d76605 OpenJDK-11 upstream commit: https://github.com/openjdk/jdk11u/commit/17181e7ce734a7c0432ef318b634d20f035470c6 OpenJDK-8 upstream commit: http://hg.openjdk.java.net/jdk8u/monojdk8u/rev/ee75a4b0767b
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:1445 https://access.redhat.com/errata/RHSA-2022:1445
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:1442 https://access.redhat.com/errata/RHSA-2022:1442
Oracle CPU April 2022: https://www.oracle.com/security-alerts/cpuapr2022.html#AppendixJAVA Fixed in Oracle Java SE 7u341, 8u331, 11.0.15, 17.0.3, 18.0.1.
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2022:1440 https://access.redhat.com/errata/RHSA-2022:1440
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2022:1487 https://access.redhat.com/errata/RHSA-2022:1487
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions Via RHSA-2022:1488 https://access.redhat.com/errata/RHSA-2022:1488
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Extended Update Support Via RHSA-2022:1489 https://access.redhat.com/errata/RHSA-2022:1489
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Extended Update Support Via RHSA-2022:1490 https://access.redhat.com/errata/RHSA-2022:1490
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:1491 https://access.redhat.com/errata/RHSA-2022:1491
This issue has been addressed in the following products: Red Hat Build of OpenJDK 8u332 Via RHSA-2022:1492 https://access.redhat.com/errata/RHSA-2022:1492
This issue has been addressed in the following products: Red Hat Build of OpenJDK 8u332 Via RHSA-2022:1438 https://access.redhat.com/errata/RHSA-2022:1438
This issue has been addressed in the following products: Red Hat Build of OpenJDK 11.0.15 Via RHSA-2022:1435 https://access.redhat.com/errata/RHSA-2022:1435
This issue has been addressed in the following products: Red Hat Build of OpenJDK 11.0.15 Via RHSA-2022:1439 https://access.redhat.com/errata/RHSA-2022:1439
This issue has been addressed in the following products: Red Hat Build of OpenJDK 17.0.3 Via RHSA-2022:1436 https://access.redhat.com/errata/RHSA-2022:1436
This issue has been addressed in the following products: Red Hat Build of OpenJDK 17.0.3 Via RHSA-2022:1437 https://access.redhat.com/errata/RHSA-2022:1437
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-21426
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2022:2137 https://access.redhat.com/errata/RHSA-2022:2137
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2022:1729 https://access.redhat.com/errata/RHSA-2022:1729
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2022:1728 https://access.redhat.com/errata/RHSA-2022:1728
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Supplementary Via RHSA-2023:3136 https://access.redhat.com/errata/RHSA-2023:3136