GitHub Advisoryadvisory · Maven

GHSA-523c-xh4g-mh5m Denial of Service in Apache POI

HIGH Published 2021-01-14 Modified 2026-06-09 Official page ↗
Aliases
CVE-2017-12626
Ecosystem
Maven
Packages
org.apache.poi:poi
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-835
Reviewed
2020-11-06

Affected packages

• Maven org.apache.poi:poi: < 3.17 → fixed in 3.17

Description

Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: • Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 61294) • Out of Memory Exceptions while parsing crafted DOC, PPT and XLS (POI bugs 52372 and 61295)

Related

Alias · CVE (1)

  • CVE-2017-12626 Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF,… vulnerability

Weakness · CWE (1)

  • CWE-835 Loop with Unreachable Exit Condition weakness

References