CVE-2022-26336: Improper Input Validation and Allocation of Resources Without Limits or Throttling in poi-scratchpad

org.apache.poi:poi-scratchpad Updated 02 Oct 2025

Summary

05/03/2022

Disclosed on

CVE-2022-26336

CVE

Yes i

Fix available

Moderate

Severity

5.5

CVSS Score

CVE-2022-26336: Improper Input Validation and Allocation of Resources Without Limits or Throttling in poi-scratchpad. Affects org.apache.poi:poi-scratchpad versions >= 3.8-beta1, < 5.2.1. Fixed in 5.2.1. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

poi-scratchpad is a package in Apache POI that is used to read TNEF files, which are commonly used by Microsoft Outlook and Microsoft Exchange Server. It provides functionality to parse and process these files. However, a vulnerability in the HMEF package of poi-scratchpad allows an attacker to cause an Out of Memory exception. This vulnerability affects version 5.2.0 and prior versions of poi-scratchpad.

Vulnerability Detail

The vulnerability arises due to improper input validation and the allocation of resources without limits or throttling. If an application uses poi-scratchpad to parse TNEF files and allows untrusted users to supply them, a carefully crafted file can trigger an Out of Memory exception. This can potentially lead to denial of service or other security issues. The vulnerability has a CVSS score of 5.5.

How To Fix

Minimum fixed version

5.2.1

This is the first release that contains the fix.

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of poi-scratchpad to mitigate the risk.

Conclusion

The vulnerability in poi-scratchpad can be mitigated by upgrading to version 5.2.1 or later. It is crucial to keep dependencies up to date to ensure the security of applications. For further support on vulnerability remediation, contact DevNack.com.

See every vulnerability recorded for org.apache.poi:poi-scratchpad →