Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Apache POI POI‑OOXML update prevents possible data breach
published 3 months ago
Summary
The Apache POI POI‑OOXML library, used for handling Microsoft Office files, contained a security weakness that could let an attacker tamper with or extract data. The TuxCare rebuild fixes the issue in version 4.1.2‑tuxcare.2. Apply this updated version to all systems that use the POI, POI‑examples, POI‑excelant, POI‑OOXML, or POI‑OOXML‑schemas packages.
What to do
- Update apache org.apache.poi:poi to version 4.1.2-tuxcare.2.
- Update apache org.apache.poi:poi-examples to version 4.1.2-tuxcare.2.
- Update apache org.apache.poi:poi-excelant to version 4.1.2-tuxcare.2.
- Update apache org.apache.poi:poi-ooxml to version 4.1.2-tuxcare.2.
- Update apache org.apache.poi:poi-ooxml-schemas to version 4.1.2-tuxcare.2.
- Update apache org.apache.poi:poi-scratchpad to version 4.1.2-tuxcare.2.
- Update org.apache.poi:poi-examples to version 4.1.2-tuxcare.2.
- Update org.apache.poi:poi-excelant to version 4.1.2-tuxcare.2.
- Update org.apache.poi:poi-ooxml to version 4.1.2-tuxcare.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:Maven | apache | org.apache.poi:poi |
>= 4.1.2, < 4.1.2-tuxcare.2 Fix: upgrade to 4.1.2-tuxcare.2
|
| TuxCare:Maven | apache | org.apache.poi:poi-examples |
>= 4.1.2, < 4.1.2-tuxcare.2 Fix: upgrade to 4.1.2-tuxcare.2
|
| TuxCare:Maven | apache | org.apache.poi:poi-excelant |
>= 4.1.2, < 4.1.2-tuxcare.2 Fix: upgrade to 4.1.2-tuxcare.2
|
| TuxCare:Maven | apache | org.apache.poi:poi-ooxml |
>= 4.1.2, < 4.1.2-tuxcare.2 Fix: upgrade to 4.1.2-tuxcare.2
|
| TuxCare:Maven | apache | org.apache.poi:poi-ooxml-schemas |
>= 4.1.2, < 4.1.2-tuxcare.2 Fix: upgrade to 4.1.2-tuxcare.2
|
| TuxCare:Maven | apache | org.apache.poi:poi-scratchpad |
>= 4.1.2, < 4.1.2-tuxcare.2 Fix: upgrade to 4.1.2-tuxcare.2
|
| TuxCare:Maven | – | org.apache.poi:poi-examples |
>= 4.1.2, < 4.1.2-tuxcare.2 Fix: upgrade to 4.1.2-tuxcare.2
|
| TuxCare:Maven | – | org.apache.poi:poi-excelant |
>= 4.1.2, < 4.1.2-tuxcare.2 Fix: upgrade to 4.1.2-tuxcare.2
|
| TuxCare:Maven | – | org.apache.poi:poi-ooxml |
>= 4.1.2, < 4.1.2-tuxcare.2 Fix: upgrade to 4.1.2-tuxcare.2
|
Original advisory text
TuxCare security update for org.apache.poi:poi-ooxml (1 CVE)
TuxCare rebuilt org.apache.poi:poi-ooxml to address 1 CVE. Fixed in 4.1.2-tuxcare.2.
Timeline
Published4 Aug 2026
Updated2 Nov 2026
First seen15 Oct 2026
Sources
CLSA-2026-1778028244 · OSV
Track software like this
Free during beta