Apache Calcite: potential XEE attacks
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
Apache Calcite 1.22.0 introduced the SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM and EXTRACT_VALUE do not restrict XML External Entity references in their configuration, making them vulnerable to a potential XML External Entity (XXE) attack. Therefore any client exposing these operators, typically by using Oracle dialect (the first three) or MySQL dialect (the last one), is affected by this vulnerability (the extent of it will depend on the user under which the application is running). From Apache Calcite 1.32.0 onwards, Document Type Declarations and XML External Entity resolution are disabled on the impacted operators.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Calcite | 1.22.0 to before 1.32.0 | 1.32.0 | Patch available | CNA |
| — | org.apache.calcite:calcite-core (Maven) | 1.22.0 to before 1.32.0 | 1.32.0 | Patch available | GHSA-fj2m-w3wv-x9pr |
- Apache Calcite VendorApache Affected 1.22.0 to before 1.32.0 Fixed in 1.32.0 Patch available CNA
- org.apache.calcite:calcite-core (Maven) Vendor— Affected 1.22.0 to before 1.32.0 Fixed in 1.32.0 Patch available GHSA-fj2m-w3wv-x9pr
Remediation
- Fix · CNA Apache Calcite (Apache Software Foundation) Fixed in 1.32.0
- Fix · GHSA-fj2m-w3wv-x9pr org.apache.calcite:calcite-core (Maven) Fixed in 1.32.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Fuse 7 | Affected | No fix yet: Fix deferred |
Not affected: 3 products
- Red Hat Data Grid 8
- Red Hat Integration Camel K 1
- Red Hat JBoss Data Grid 7
Timeline
- 2026-10-02 Threatist record created from CVE-2022-39135
- 2026-10-03 Alias added: GHSA-fj2m-w3wv-x9pr
References
Advisory 3
Other 9
- https://github.com/apache/calcite/commit/1ddc1c3a0c61
- https://github.com/apache/calcite/commit/ba80b9156afc0db26b194d97a031fcc0dc7f4c03
- https://calcite.apache.org/news/2022/09/10/release-1.32.0
- https://github.com/apache/calcite
- https://github.com/apache/calcite/blob/calcite-1.22.0/core/src/main/java/org/apache/calcite/runtime/XmlFunctions.java
- https://github.com/apache/calcite/blob/calcite-1.31.0/core/src/main/java/org/apache/calcite/runtime/XmlFunctions.java
- https://github.com/apache/calcite/blob/calcite-1.32.0/core/src/main/java/org/apache/calcite/runtime/XmlFunctions.java
- https://github.com/apache/calcite/tree/calcite-1.19.0/core/src/main/java/org/apache/calcite/runtime
- https://issues.apache.org/jira/browse/CALCITE-5263
More Apache Calcite vulnerabilities
- TI-2026-34343 Apache Calcite: A user-controled model can load arbitrary classes, leading to code execution CVSS 3.1MEDIUM 6.5
- TI-2020-10931 Improper certificate validation in Apache Calcite CVSS 3.1MEDIUM 5.9
Sources
- CVE-2022-39135 · CVE Program
- CVE-2022-39135 · NVD
- FIRST EPSS
- GHSA-fj2m-w3wv-x9pr · GitHub Advisory Database · CC BY 4.0
- CVE-2022-39135 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences