Homepage

CVE-2014-3574 The advisory has been revoked - it doesn't affect any version of package apache-poi.src  (opens in a new tab)

Threat Intelligence

EPSS
11.11% (94th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-APACHEPOISRC-15132475
  • published29 Jan 2026
  • disclosed18 Aug 2014
Report a new vulnerability Found a mistake?

Introduced: 18 Aug 2014

CVE-2014-3574  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream apache-poi.src package and not the apache-poi.src package as distributed by RHEL.

Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service (CPU consumption and crash) via a crafted OOXML file, aka an XML Entity Expansion (XEE) attack.

References