CVE-2022-40160

6.5 mediumEPSS 1.4%Disputed

Medium (6.5) in apache commons jxpath. Disputed: the vendor or another party disputes that this is a vulnerability. EPSS 1.4% chance of exploitation in the next 30 days.

This record was originally reported by the oss-fuzz project who failed to consider the security context in which JXPath is intended to be used and failed to contact the JXPath maintainers prior to requesting the CVE allocation. The CVE was then allocated by Google in breach of the CNA rules. After review by the JXPath maintainers, the original report was found to be invalid.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS: 1.4% chance of exploitation in the next 30 days; higher than 73% of CVEs (scores of 2026-10-31)
CWEs: CWE-787, CWE-121
Published: 2022-10-06
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

apache:commons_jxpath

References

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47053
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47053

Check your stack JSON