CVE-2014-3574
Improper Input Validation in Apache POI
Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service (CPU consumption and crash) via a crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
Exploit likelihood
What each source reports
NVD Score used
Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service (CPU consumption and crash) via a crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
- Record
CVE-2014-3574- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service (CPU consumption and crash) via a crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
- Record
CVE-2014-3574- Updated
- 2026-11-02
EUVDEUVD-2022-2665 No score
Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service (CPU consumption and crash) via a crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
- Record
EUVD-2022-2665- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5wfp-8643-c58x No score
Improper Input Validation in Apache POI
Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service (CPU consumption and crash) via a crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
- Record
GHSA-5wfp-8643-c58x- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVCLSA-2026-1777941834 No score
TuxCare security update for org.apache.poi (5 CVEs)
TuxCare rebuilt 3 org.apache.poi packages to address 5 CVEs. Fixed in 3.10-FINAL-tuxcare.1.
- Record
CLSA-2026-1777941834- Updated
- 2026-11-02
OSV No score
Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service (CPU consumption and crash) via a crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
- Record
CVE-2014-3574- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-3574 No score
Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service (CPU consumption and crash) via a crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
- Record
DEBIAN-CVE-2014-3574- Updated
- 2026-11-02
OSVGHSA-5wfp-8643-c58x No score
Improper Input Validation in Apache POI
Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service (CPU consumption and crash) via a crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
- Record
GHSA-5wfp-8643-c58x- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVMGASA-2014-0550 No score
Updated apache-poi packages fix security vulnerabilities
Updated apache-poi packages fix security vulnerabilities:
It was found that Apache POI would resolve entities in OOXML documents. A remote attacker able to supply OOXML documents that are parsed by Apache POI could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks (CVE-2014-3529).
It was found that Apache POI would expand an unlimited number of entities in OOXML documents. A remote attacker able to supply OOXML documents that are parsed by Apache POI could use this flaw to trigger a denial of service attack via excessive CPU and memory consumption (CVE-2014-3574).
- Record
MGASA-2014-0550- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.poi:poiMaven |
before 3.10.1 | 3.10.1 |
org.apache.poi:poiMaven |
3.11-beta1 to 3.11-beta1 | 3.11-beta2 |
org.apache.poi:poiTuxCare:Maven |
3.10-FINAL up to 3.10-FINAL-tuxcare.1 | 3.10-FINAL-tuxcare.1 |
org.apache.poi:poi-ooxmlTuxCare:Maven |
3.10-FINAL up to 3.10-FINAL-tuxcare.1 | 3.10-FINAL-tuxcare.1 |
org.apache.poi:poi-scratchpadTuxCare:Maven |
3.10-FINAL up to 3.10-FINAL-tuxcare.1 | 3.10-FINAL-tuxcare.1 |
libapache-poi-javaDebian:12 |
before 3.10.1-1 | 3.10.1-1 |
libapache-poi-javaDebian:13 |
before 3.10.1-1 | 3.10.1-1 |
libapache-poi-javaDebian:14 |
before 3.10.1-1 | 3.10.1-1 |
org.apache.poi:poiMaven |
before 3.10.1, plus listed versions 3.0-FINAL3.0.1-FINAL3.0.2-FINAL3.0.2-beta13.0.2-beta2 Show 25 moreShow less3.1-FINAL3.1-beta13.1-beta23.10-FINAL3.10-beta13.10-beta23.2-FINAL3.5-FINAL3.5-beta13.5-beta33.5-beta43.5-beta53.5-beta63.63.73.7-beta13.7-beta23.7-beta33.83.8-beta13.8-beta23.8-beta33.8-beta43.8-beta53.9 |
3.10.1 |
org.apache.poi:poiMaven |
3.11-beta1 up to 3.11-beta2 | 3.11-beta2 |
apache-poiMageia:4 |
before 3.10.1-1.mga4 | 3.10.1-1.mga4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| affected | OSV | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-3574 is a medium vulnerability (CVSS 4.3) in Apache Poi, published September 4, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.11%, the 94th percentile. Fixed in org.apache.poi:poi 3.10.1.
References
www-01.ibm.com/support/docview.wss?uid=swg21996759
securityfocus.com/bid/69648
poi.apache.org/changes.html
secunia.com/advisories/61766
lucene.apache.org/solr/solrnews.html
rhn.redhat.com/errata/RHSA-2014-1370.html
Show 18 moreShow less
apache.org/dist/poi/release/RELEASE-NOTES.txt
exchange.xforce.ibmcloud.com/vulnerabilities/95768
nvd.nist.gov/vuln/detail/CVE-2014-3574
svn.apache.org/repos/asf/poi/branches/REL_3_10_BRANCH@1616509
github.com/advisories/GHSA-5wfp-8643-c58x
security-tracker.debian.org/tracker/CVE-2014-3574
advisories.mageia.org/MGASA-2014-0550.html
bugs.mageia.org/show_bug.cgi?id=14128
lists.fedoraproject.org/pipermail/package-announce/2014-September/137802.html