CVE-2014-3574
Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service (CPU consumption and crash) via a crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
- EPSS
- 7.1% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:poi
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-5wfp-8643-c58x | Maven | org.apache.poi:poi | <3.10.1 | 3.10.1 |
| GHSA-5wfp-8643-c58x | Maven | org.apache.poi:poi | >=3.11-beta1 <3.11-beta2 | 3.11-beta2 |