# CVE-2022-39135: Apache Calcite before 1.32.0 vulnerable to potential XML External Entity (XXE) attack

Source: https://junglewise.ai/threats/cve-2022-39135-apache-calcite-before-1-32-0-vulnerable-to-potential-xml-external  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-09-12  
License: CC BY 4.0 with a link back

CVE-2022-39135 · Severity: critical · CVSS 9.8 · Published 2022-09-12

In Apache Calcite prior to version 1.32.0 the SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM and EXTRACT_VALUE do not restrict XML External Entity references in their configuration, which makes them vulnerable to a potential XML External Entity (XXE) attack. Therefore any client exposing these operators, typically by using Oracle dialect (the first three) or MySQL dialect (the last one), is affected by this vulnerability (the extent of it will depend on the user under which the application is running). From Apache Calcite 1.32.0 onwards, Document Type Declarations and XML External Entity resolution are disabled on the impacted operators.

Technologies: [org.apache.calcite:calcite-core (Maven)](https://junglewise.ai/threats/technologies/org-apache-calcite-calcite-core). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2022-39135 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-39135 being exploited in the wild.

**How severe is CVE-2022-39135?** Critical severity, with a CVSS score of 9.8, published 12 September 2022.

**Which products and versions are affected?** org.apache.calcite:calcite-core (Maven) >= 1.22.0, < 1.32.0, ECOSYSTEM:introduced=0,fixed=1.32.0.

**Is there a fix for CVE-2022-39135?** Yes. org.apache.calcite:calcite-core (Maven): upgrade to 1.32.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2022-39135?** Check whether you run org.apache.calcite:calcite-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.apache.calcite:calcite-core (Maven): upgrade to 1.32.0 or later

  ```sh
  # set org.apache.calcite:calcite-core to 1.32.0 in your pom.xml or build.gradle
  ```


## Affected products

- org.apache.calcite:calcite-core (Maven) >= 1.22.0, < 1.32.0, ECOSYSTEM:introduced=0,fixed=1.32.0

## Identifiers

- CVE-2022-39135
- GHSA-fj2m-w3wv-x9pr

## Related threats

- [Apache Calcite unsafe reflection in user-controlled models](https://junglewise.ai/threats/cve-2026-46718-apache-calcite-unsafe-reflection-in-user-controlled-models)
- [Missing Authentication for Critical Function in Apache Calcite](https://junglewise.ai/threats/cve-2020-13955-missing-authentication-for-critical-function-in-apache-calcite)