Product · Apache Software Foundation

Apache POI

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

Medium 5.3

CVE-2025-31672

Apache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying zip has duplicate zip entry names

Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries with duplicate names (inc…

Apache Software Foundation Apache POI libapache-poi-java libapache-poi-java Debian Ubuntu Maven

Apr 9, 2025
Medium 5.5

CVE-2017-5644

Improper Restriction of Recursive Entity References in DTDs in Apache POI

Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack.

Apache Software Foundation Apache POI libapache-poi-java org.apache.poi:poi Debian Ubuntu Maven

Mar 24, 2017