moestika opened a new issue, #1447: URL: https://github.com/apache/poi/issues/1447
### Summary Our enterprise CI/CD security pipeline (Sonatype Nexus IQ Server & Fortify SSC) has recently flagged **`org.apache.poi:poi:5.5.1`** with a high-severity security advisory: * **Advisory ID:** `sonatype-2026-009431` * **Severity / CVSS Score:** 8.7 (High / Critical) * **Affected Artifact:** `org.apache.poi:poi:5.5.1` ### Impact As version **`5.5.1`** is currently the latest stable release published on Maven Central, enterprise security compliance gates and policy enforcements are blocking builds and production deployment pipelines due to this newly disclosed vulnerability advisory. ### Questions & Request 1. Is the Apache POI team already aware of this advisory / vulnerability (`sonatype-2026-009431`)? 2. Has a fix already been committed to `trunk` / the main development branch? 3. Is there an estimated timeline or plan for an upcoming patch release (such as **5.5.2**) or the next major milestone (**6.0.0**) to address this on Maven Central? 4. In the meantime, are there recommended application-level workarounds or configuration mitigations (e.g., specific parser limits or configuration flags) that can be applied to mitigate this risk? Thank you very much to the Apache POI team and maintainers for your continued dedication to this vital project! -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
