Collected research

Exploiting Java's XML Signature Verification

Gregor Samsa: Exploiting Java's XML Signature Verification

Felix Wilhelm · projectzero.google

CVE-2022-34169: an integer truncation bug in the XSLTC JIT compiler that Java reaches during XML signature verification. Because XMLDsig lets a signature embed an XSLT transform, an unauthenticated attacker can overflow the generated class constant pool and execute arbitrary JVM bytecode on any SAML endpoint that verifies attacker-supplied signatures.

Record

Document

Gregor Samsa: Exploiting Java's XML Signature Verification

Researcher

Felix Wilhelm

Published by

projectzero.google

Topic

Server

In the archive

• Collected in the 2022 research round

Related sources

• Independent exploit writeup
• Author proof of concept

Tags

• rce
• saml
• sso
• java
• cve
• attack-chain
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Felix Wilhelm, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 11 August 2026.