CVE-2017-5644

CVE-2017-5644: vulnerability in Apache POI

Published · Updated

Follow this CVE+ Monitor Apache POI+ Monitor libapache-poi-java

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 4.6%
Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
Affected products
Apache Software Foundation · Apache POI
Related CVEs — Apache POI

In the same product, most dangerous first.

CVE-2017-12626HIGHCVE-2017-12626EPSS 10.1%CVE-2025-31672MEDIUMApache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying zip has duplicate zip entry namesEPSS 1.4%