Denial of Service Vulnerability in docx4j OpenXML Java Library
CVE-2026-53752
What is CVE-2026-53752?
The docx4j library, an open-source Java tool for handling OpenXML packages, is prone to a denial of service vulnerability. Prior to version 11.5.14, the library's PropertyResolver and related components followed style inheritance chains in WordprocessingML without detecting cycles. This flaw could lead to unbounded recursion when processing well-formed DOCX documents featuring mutually based styles. Such scenarios can trigger a StackOverflowError during server-side conversion or table-of-contents processing, potentially disrupting worker threads and degrading service availability. However, with proper handling through isolated disposable workers, the effects can be mitigated. The issue has been addressed in version 11.5.14 with the introduction of cyclic-style tracking and CyclicStylesException handling.
Affected Version(s)
docx4j < 11.5.14
docx4j-core < 11.5.14