Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Apache POI libraries may let attackers run code
published 3 months ago
Summary
The Apache POI Java libraries used for handling Microsoft Office files (including poi, poi‑examples, poi‑excelant, poi‑ooxml, and poi‑ooxml‑schemas) contain several weaknesses that could let a crafted document trigger unwanted actions on a system. Updating to the TuxCare‑provided version 3.10‑FINAL‑tuxcare.1 fixes these issues. Apply the rebuilt packages as soon as possible to keep your applications safe.
What to do
- Update apache org.apache.poi:poi to version 3.10-FINAL-tuxcare.1.
- Update apache org.apache.poi:poi-examples to version 3.10-FINAL-tuxcare.1.
- Update apache org.apache.poi:poi-excelant to version 3.10-FINAL-tuxcare.1.
- Update apache org.apache.poi:poi-ooxml to version 3.10-FINAL-tuxcare.1.
- Update apache org.apache.poi:poi-ooxml-schemas to version 3.10-FINAL-tuxcare.1.
- Update apache org.apache.poi:poi-scratchpad to version 3.10-FINAL-tuxcare.1.
- Update org.apache.poi:poi to version 3.10-FINAL-tuxcare.1.
- Update org.apache.poi:poi-examples to version 3.10-FINAL-tuxcare.1.
- Update org.apache.poi:poi-excelant to version 3.10-FINAL-tuxcare.1.
- Update org.apache.poi:poi-ooxml to version 3.10-FINAL-tuxcare.1.
- Update org.apache.poi:poi-scratchpad to version 3.10-FINAL-tuxcare.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:Maven | apache | org.apache.poi:poi |
>= 3.10-FINAL, < 3.10-FINAL-tuxcare.1 Fix: upgrade to 3.10-FINAL-tuxcare.1
|
| TuxCare:Maven | apache | org.apache.poi:poi-examples |
>= 3.10-FINAL, < 3.10-FINAL-tuxcare.1 Fix: upgrade to 3.10-FINAL-tuxcare.1
|
| TuxCare:Maven | apache | org.apache.poi:poi-excelant |
>= 3.10-FINAL, < 3.10-FINAL-tuxcare.1 Fix: upgrade to 3.10-FINAL-tuxcare.1
|
| TuxCare:Maven | apache | org.apache.poi:poi-ooxml |
>= 3.10-FINAL, < 3.10-FINAL-tuxcare.1 Fix: upgrade to 3.10-FINAL-tuxcare.1
|
| TuxCare:Maven | apache | org.apache.poi:poi-ooxml-schemas |
>= 3.10-FINAL, < 3.10-FINAL-tuxcare.1 Fix: upgrade to 3.10-FINAL-tuxcare.1
|
| TuxCare:Maven | apache | org.apache.poi:poi-scratchpad |
>= 3.10-FINAL, < 3.10-FINAL-tuxcare.1 Fix: upgrade to 3.10-FINAL-tuxcare.1
|
| TuxCare:Maven | – | org.apache.poi:poi |
>= 3.10-FINAL, < 3.10-FINAL-tuxcare.1 Fix: upgrade to 3.10-FINAL-tuxcare.1
|
| TuxCare:Maven | – | org.apache.poi:poi-examples |
>= 3.10-FINAL, < 3.10-FINAL-tuxcare.1 Fix: upgrade to 3.10-FINAL-tuxcare.1
|
| TuxCare:Maven | – | org.apache.poi:poi-excelant |
>= 3.10-FINAL, < 3.10-FINAL-tuxcare.1 Fix: upgrade to 3.10-FINAL-tuxcare.1
|
| TuxCare:Maven | – | org.apache.poi:poi-ooxml |
>= 3.10-FINAL, < 3.10-FINAL-tuxcare.1 Fix: upgrade to 3.10-FINAL-tuxcare.1
|
| TuxCare:Maven | – | org.apache.poi:poi-scratchpad |
>= 3.10-FINAL, < 3.10-FINAL-tuxcare.1 Fix: upgrade to 3.10-FINAL-tuxcare.1
|
Original advisory text
TuxCare security update for org.apache.poi (5 CVEs)
TuxCare rebuilt 3 org.apache.poi packages to address 5 CVEs. Fixed in 3.10-FINAL-tuxcare.1.
Timeline
Published4 Aug 2026
Updated2 Nov 2026
First seen15 Oct 2026
Sources
CLSA-2026-1777941834 · OSV
Track software like this
Free during beta