High
CVE-2022-39135
Apache Calcite is vulnerable to an XML external entity injection (XXE) attack when processing XML data, caused by improper input validation by the SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM and EXTRACT_VALUE. By using specially-crafted XML content, a remote attacker could exploit this vulnerability to read arbitrary files, cause a denial of service, conduct an SSRF attack, or achieve other system impacts.
Apache
Upgrade to the latest version of Apache Calcite, available from the Apache Website.