Infinite loop in Apache POI
Priority MEDIUM 51CWE-835Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 2 fixed, 5 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-835.
Summary
Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 61294), and 2) Out of Memory Exceptions while parsing crafted DOC, PPT and XLS (POI bugs 52372 and 61295).
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.10142 95th percentileScored 2026-11-07
Fix Partial Apache POI (Apache Software Foundation): 3.17org.apache.poi:poi (Maven): 3.17Red Hat: 1 advisoryRed Hat: 2 fixed, 5 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache POI | before 3.17 | 3.17 | Patch available | CNA |
| — | org.apache.poi:poi (Maven) | before 3.17 | 3.17 | Patch available | GHSA-523c-xh4g-mh5m |
- Apache POI VendorApache Affected before 3.17 Fixed in 3.17 Patch available CNA
- org.apache.poi:poi (Maven) Vendor— Affected before 3.17 Fixed in 3.17 Patch available GHSA-523c-xh4g-mh5m
Remediation
- Fix · CNA Apache POI (Apache Software Foundation) Fixed in 3.17
- Fix · GHSA-523c-xh4g-mh5m org.apache.poi:poi (Maven) Fixed in 3.17 Advisory →
Red Hat 1 advisory
- RHSA-2018:1322 Released 2018-05-03 · Red Hat rating ModerateRed Hat JBoss Fuse/A-MQ 6.3 R7 security and bug fix update
- Red Hat JBoss A-MQ 6.3
- Red Hat JBoss Fuse 6.3
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat BPM Suite 6 | Affected | No fix yet |
| Red Hat JBoss BRMS 6 | Affected | No fix yet |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Portal 6 | Affected | No fix planned: Will not fix |
| Red Hat JBoss A-MQ 6.3 | Fixed | RHSA-2018:1322 |
| Red Hat JBoss Fuse 6.3 | Fixed | RHSA-2018:1322 |
Not affected: 2 products
- Red Hat Enterprise Linux 8
- Red Hat JBoss BRMS 5
Timeline
- 2026-10-02 Threatist record created from CVE-2017-12626
- 2026-10-03 Alias added: GHSA-523c-xh4g-mh5m
References
Other 12
- [dev] 20180126 CVE-2017-12626 - Denial of Service Vulnerabilities in Apache POI < 3.17
- [lucene-solr-user] 20190104 Re: SOLR v7 Security Issues Caused Denial of Use - Sonatype Application Composition Report
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://github.com/apache/poi
- https://lists.apache.org/thread.html/453d9af5dbabaccd9afb58d27279a9dbfe8e35f4e5ea1645ddd6960b@%3Cdev.poi.apache.org%3E
- https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E
More Apache Poi vulnerabilities
- TI-2014-02855 The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary… CVSS 2.0MEDIUM 4.3
- TI-2025-22816 Improper input validation in Apache POI CVSS 3.1MEDIUM 5.3
- TI-2012-00206 The UnhandledDataStructure function in hwpf/model/UnhandledDataStructure.java in Apache… CVSS 2.0MEDIUM 5.0
- TI-2017-03644 Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of… CVSS 3.0MEDIUM 5.5
- TI-2016-04320 The XLSX2CSV example in Apache POI before 3.14 allows remote attackers to read arbitrary… CVSS 3.0MEDIUM 5.5
- TI-2014-07749 HSLFSlideShow in Apache POI before 3.11 allows remote attackers to cause a denial of… CVSS 2.0MEDIUM 5.0
Sources
- CVE-2017-12626 · CVE Program
- CVE-2017-12626 · NVD
- FIRST EPSS
- GHSA-523c-xh4g-mh5m · GitHub Advisory Database · CC BY 4.0
- CVE-2017-12626 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences