Description
Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service (CPU consumption and crash) via a crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libapache-poi-java | 3.10.1-1 | — |
| Debian 13 | libapache-poi-java | 3.10.1-1 | — |
| Debian 12 | libapache-poi-java | 3.10.1-1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.poi:poi | < 3.10.1 | 3.10.1 | GHSA-5wfp-8643-c58x |
| Maven | org.apache.poi:poi | >= 3.11-beta1, < 3.11-beta2 | 3.11-beta2 | GHSA-5wfp-8643-c58x |
Advisories 1
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
References
- http://www-01.ibm.com/support/docview.wss?uid=swg21996759
- 69648 vdb-entry
- http://poi.apache.org/changes.html
- 61766 third-party-advisory
- https://lucene.apache.org/solr/solrnews.html#18-august-2014-recommendation-to-update-apache-poi-in-apache-solr-480-481-and-490-installations
- RHSA-2014:1370 vendor-advisory
- http://www.apache.org/dist/poi/release/RELEASE-NOTES.txt
- 60419 third-party-advisory
- apache-poi-cve20143574-dos(95768) vdb-entry
- RHSA-2014:1400 vendor-advisory
- RHSA-2014:1398 vendor-advisory
- 59943 third-party-advisory
- RHSA-2014:1399 vendor-advisory