Apache POI Denial of Service Vulnerability in Document Processing

CVE-2012-0213

Summary

The UnhandledDataStructure function in the Apache POI library versions 3.8 and earlier is susceptible to a denial of service attack. By submitting a specially crafted document with manipulated length values in the Channel Definition Format (CDF) or Compound File Binary Format (CFBF), an attacker can trigger an OutOfMemoryError. This may lead to JVM instability, affecting the availability of applications relying on Apache POI for document processing. Organizations utilizing these versions of Apache POI should take immediate actions to ensure proper input validation and consider upgrading to a secure version to mitigate this risk.

References