CVE-2017-5644: Apache Poi

Medium severity, CVSS 5.5. EPSS: 4.6% chance of exploitation in the next 30 days.

Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack.

Affected products

• Apache Poi: up to and including 3.14

Published 2017-03-24. Last modified 2026-06-17.