This is an automated email from the ASF dual-hosted git repository.
pjfanning pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/poi.git
The following commit(s) were added to refs/heads/trunk by this push:
new b4a9652ee9 OOMs
b4a9652ee9 is described below
commit b4a9652ee9caf36c78deabe99ba806f15d6ca812
Author: PJ Fanning <[email protected]>
AuthorDate: Mon May 25 21:43:30 2026 +0100
OOMs
---
src/documentation/content/xdocs/security.xml | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/src/documentation/content/xdocs/security.xml
b/src/documentation/content/xdocs/security.xml
index f82065f977..1e9ae566a5 100644
--- a/src/documentation/content/xdocs/security.xml
+++ b/src/documentation/content/xdocs/security.xml
@@ -86,6 +86,16 @@
and writing xlsx files - so if you are working with large xlsx
files, you should consider using the
streaming APIs.
</li>
+ <li><strong>OutOfMemoryErrors</strong><br/>
+ Memory usage can be high, potentially causing
OutOfMemoryErrors. Malicious actors can create files designed to exploit
parsers and generate large arrays.
+ Legacy formats (xls, doc, ppt, etc.) are particularly
vulnerable, though all formats have potential issues.
+ <br/>
+ Apache POI includes checks to detect suspicious values that
may indicate malicious content, but these checks should not be considered
comprehensive.
+ <br/>
+ We strongly recommend never parsing files from untrusted or
unknown sources.
+ <br/>
+ While we welcome suggestions for additional safeguards, we
typically do not classify these as security vulnerabilities in the POI
libraries.
+ </li>
<li><strong>Use of Temp Files</strong><br/>
Apache POI makes significant use of temporary files. You need
to ensure that the directory used
for temp files cannot be manipulated or even read by untrusted
users.
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
