CVE-2017-5644

Improper Restriction of Recursive Entity References in DTDs in Apache POI

5.5 MediumFix available

CVE-2017-5644 is a medium vulnerability (CVSS 5.5) in Apache Poi, published March 24, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.59%, the 91st percentile. Fixed in org.apache.poi:poi 3.15.

Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

4.59%Up 0.8 points since Apr 14, 2021

What each source reports

NVD Score used 5.5

Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack.

Record: CVE-2017-5644
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0: 7.1 HighAV:N/AC:M/Au:N/C:N/I:N/A:C
Weakness: CWE-776
Updated: 2026-11-02

CVE List No score

Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack.

Record: CVE-2017-5644
Updated: 2026-11-02

EUVDEUVD-2022-2955 No score

Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack.

Record: EUVD-2022-2955
Updated: 2026-11-03

GitHub AdvisoriesGHSA-78vv-qj73-h9m5 5.5

Improper Restriction of Recursive Entity References in DTDs in Apache POI

Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack.

Record: GHSA-78vv-qj73-h9m5
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-776
Updated: 2026-11-02

OSV 5.5

Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack.

Record: CVE-2017-5644
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2017-5644 5.5

Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack.

Record: DEBIAN-CVE-2017-5644
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVGHSA-78vv-qj73-h9m5 5.5

Improper Restriction of Recursive Entity References in DTDs in Apache POI

Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack.

Record: GHSA-78vv-qj73-h9m5
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-776
Updated: 2026-11-02

OSVUBUNTU-CVE-2017-5644 5.5

Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack.

Record: UBUNTU-CVE-2017-5644
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.apache.poi:poi` Maven	before 3.15	3.15
`libapache-poi-java` Debian:12	before 3.17-1	3.17-1
`libapache-poi-java` Debian:13	before 3.17-1	3.17-1
`libapache-poi-java` Debian:14	before 3.17-1	3.17-1
`org.apache.poi:poi` Maven	before 3.15, plus listed versions 3.0-FINAL3.0.1-FINAL3.0.2-FINAL3.0.2-beta13.0.2-beta2 Show 38 moreShow less 3.1-FINAL3.1-beta13.1-beta23.10-FINAL3.10-beta13.10-beta23.10.13.113.11-beta13.11-beta23.11-beta33.123.12-beta13.133.13-beta13.143.14-beta13.15-beta13.15-beta23.2-FINAL3.5-FINAL3.5-beta13.5-beta33.5-beta43.5-beta53.5-beta63.63.73.7-beta13.7-beta23.7-beta33.83.8-beta13.8-beta23.8-beta33.8-beta43.8-beta53.9	3.15
`libapache-poi-java` Ubuntu:16.04:LTS	All versions, plus listed versions 3.10.1-2	None known

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV