CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets

Security readout for executives and security teams

This flaw lets a malicious XSLT stylesheet abuse Apache Xalan-J’s XSLTC compiler path to alter generated Java class files and run attacker-controlled Java bytecode. Business risk is highest where applications accept or transform untrusted XSLT/XML content, including through bundled Java runtime copies. Exposure is likely in Java applications, middleware, or platforms using Xalan-J or runtime-bundled Xalan to process attacker-supplied XSLT. Dependency and runtime inventories are necessary because repackaged copies may not appear as direct application dependencies. Treat as high priority for Java services that transform untrusted XSLT or depend on affected runtimes. Patch direct libraries and vendor runtimes, then verify no exposed workflow accepts attacker-controlled stylesheets. Mitigation focus: Upgrade Apache Xalan-J to version 2.7.3 or later where directly used.; Apply Java runtime and vendor updates that replace repackaged Xalan copies.; Review Oracle, Debian, Fedora, and product-vendor advisories for affected packages..

Prepared

Jun 1, 2026, 02:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.