pjfanning commented on issue #1447: URL: https://github.com/apache/poi/issues/1447#issuecomment-6275045982
There is no CVE. We have not requested one for POI. I was able to trace this partially. It appears to be an ossfuzz report that was made public because the test case is now passing. I don't know what the test case is but it appears to something to do with formula eval with is an advanced feature that you need to call explicitly. * https://guide.sonatype.com/vulnerability/sonatype-2026-009431 * https://issues.oss-fuzz.com/issues/490896964 I made some formula evaluation fixes and DataFormatter fixes in the last few days and may have accidentally fixed this issue. POI 6.0.0 RC1 is ready - built today. Nothing to do with this report though but it likely includes the fix for this issue. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
