RHLW-2026-cd97e66695607070
- Source
- https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-cd97e66695607070.json
- Import Source
- https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-cd97e66695607070.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/RHLW-2026-cd97e66695607070
- Upstream
- Published
- 2026-10-08T19:46:30Z
- Modified
- 2026-10-22T00:08:27Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
- Summary
- Lightwell Security Advisory: xalan-bcel-6.6.1 2.7.2.Final-rhlw-00004
- Details
-
Red Hat Lightwell has released xalan:xalan-bcel-6.6.1 2.7.2.Final-rhlw-00004 with a backported security fix.
CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets
This patched artifact is a drop-in replacement for xalan:xalan-bcel-6.6.1 2.7.2.Final from Maven Central.
- References
-
- https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kyw
- https://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/34xxx/CVE-2022-34169.json
- https://nvd.nist.gov/vuln/detail/CVE-2022-34169
- https://github.com/advisories/GHSA-9339-86wc-4qgf
- Credits
-
-
- Red Hat Lightwell - REMEDIATION_DEVELOPER
-
Affected packages
Red Hat Lightwell:Maven / xalan:xalan-bcel-6.6.1
Package
- Name
- xalan:xalan-bcel-6.6.1
- Purl
- pkg:maven/xalan/xalan-bcel-6.6.1
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed2.7.2.Final-rhlw-00004
Database specific
lightwell
{
"backport_base_version": "2.7.2.Final",
"remediated_version": "2.7.2.Final-rhlw-00004",
"repository_url": "https://packages.redhat.com/lightwell/java/remediated/"
}
source
"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-cd97e66695607070.json"