Improper Restriction of Recursive Entity References in DTDs in Apache POI

published 2017-03-24 9 y ago modified 2026-06-17 4 mo ago also GHSA-78vv-qj73-h9m5 , EUVD-2022-2955

cvss: 5.5; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 4.6%; EPSS 4.6% chance of exploitation in 30 days, percentile 91%
public exploits: 0; none known

Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack.

Patch / fix

fixed in 1 distros 1

maven org.apache.poi:poi 3.15

libapache-poi-java Debian 14, Debian 13, Debian 12 3.17-1

debian advisories DEBIAN-CVE-2017-5644

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-5644 updated 2025-11-21 cvss 7.5

apache-poi: XML entity expansion via specially crafted OOXML file

Red Hat All currently supported Red Hat products
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

4.59% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	3.0	5.5	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD	2.0	7.1	AV:N/AC:M/Au:N/C:N/I:N/A:C
GitHub	3.0	5.5	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
maven	org.apache.poi:poi	<3.15	3.15

Affected products

Apache Software Foundation Apache POI

Classification

Weakness

CWE-776 Improper Restriction of Recursive Entity References in DTDs

References

poi.apache.org /#20+March+2017+-+CVE-2017-5644+-+Possible+DOS+%28Denial+of+Service%29+in+Apache+POI+versions+prior+to+3.15
web, vendor-advisory
securityfocus.com /bid/96983
vdb-entry, web
oracle.com /security-alerts/cpuoct2020.html
web
nvd.nist.gov /vuln/detail/CVE-2017-5644
advisory

Sources

CVE List CVE-2017-5644
GitHub Advisory GHSA-78vv-qj73-h9m5
NVD CVE-2017-5644

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary