{"schemaVersion":3,"id":"CVE-2025-31672","aliases":["UBUNTU-CVE-2025-31672","DEBIAN-CVE-2025-31672","CGA-5pfp-fmc9-vhf3","CGA-fg22-2q6p-j2mr","CGA-23hx-xhcp-6f2f","CGA-2frp-5g99-w94j","CGA-2gvw-673w-pwpf","CGA-2j8w-hxvg-4q8r","CGA-2pjm-pw45-mj2g","CGA-2q9j-wwqw-mpm2","CGA-2xv6-qrjv-w63v","CGA-3m7p-234v-v44m","CGA-3pr2-xvqj-w4xg","CGA-3v42-rmwr-vpcm","CGA-4g6f-9v9f-m8x3","CGA-4p8f-gw95-p487","CGA-4pj5-fp9c-jww8","CGA-5c9g-w4g4-6q5p","CGA-5cvf-c865-x9q7","CGA-5jwf-493r-g3g5","CGA-5v85-85qh-6hwf","CGA-684x-q644-h224","CGA-6fmf-x5xm-29xx","CGA-6fr6-4985-g545","CGA-6pcc-qm33-64gr","CGA-6wrv-xfwm-9h55","CGA-6xrv-fpg5-7g8g","CGA-798p-m88x-fv89","CGA-7r2v-v5qq-cfhg","CGA-7w43-rg49-cwgc","CGA-86rp-964r-cq3f","CGA-8c79-gjx4-mg5x","CGA-8gg2-h22h-fcxv","CGA-8hr6-hvg7-xwx2","CGA-8q6h-5v9q-mqwr","CGA-937x-xgw3-w7rq","CGA-9535-wvcf-q284","CGA-9r5p-6jj8-7qgp","CGA-9wqw-45p7-23rq","CGA-c52h-545h-jxhx","CGA-c62c-cx5c-c466","CGA-c7m3-6662-w9rm","CGA-cff3-qfwx-4prx","CGA-cm4w-2w7p-v36w","CGA-cw6r-63w2-7p28","CGA-f4mr-3wmv-9jgg","CGA-f5pc-85g9-qv8r","CGA-f65q-m5g9-vqwg","CGA-f6r3-97h9-jc7j","CGA-fj56-2395-vq2j","CGA-fxqp-32mv-h5c6","CGA-gf88-qc5c-942p","CGA-gjpv-rwf8-wgm6","CGA-gqg6-qxx4-397p","CGA-gvpf-r957-4mcg","CGA-h425-j7pf-3jqf","CGA-h7p4-277p-89g6","CGA-h92v-xj2h-hhqq","CGA-hq5w-chq4-c653","CGA-j2g2-v4j3-mwwh","CGA-j57g-xgj7-7wr8","CGA-jf34-m86h-432w","CGA-jhw2-x2j4-g3m9","CGA-jmvx-fv79-wph2","CGA-jp8g-8m46-h5qv","CGA-jpwq-h3x9-j6rq","CGA-jv64-hjpg-g82q","CGA-mpp4-4mgv-h7hw","CGA-mrxr-8gc5-vw56","CGA-mvfm-g3p3-52qj","CGA-p36q-h4mg-x9f8","CGA-p648-w8r6-gfv4","CGA-p7hp-m346-m5w4","CGA-pfp3-3rr4-v893","CGA-pg8c-8qmh-v99r","CGA-pm48-qfm8-pxq2","GHSA-gmg8-593g-7mv3","CGA-q3gj-vpqx-5wpj","CGA-r638-h3v2-pc29","CGA-r835-x6vv-hpgf","CGA-r9c4-vwcf-7gpg","CGA-rc7m-wqv9-g8wv","CGA-rr6j-r2h4-9pgf","CGA-rx9v-mj5r-vj7m","CGA-v242-6m4h-w296","CGA-v2jh-5742-fm9r","CGA-vg94-p56h-xj35","CGA-vv8w-v62v-jg2h","CGA-vv98-7493-834q","CGA-wj5w-m44j-cqqw","CGA-wmxw-vg53-5vp2","CGA-wx2m-389j-9hx4","CGA-xr39-3jh6-9whr"],"status":"published","duplicateOf":null,"title":null,"description":"Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries with duplicate names (including the path) in the zip. In this case, products reading the affected file could read different data because 1 of the zip entries with the duplicate name is selected over another but different products may choose a different zip entry.\nThis issue affects Apache POI poi-ooxml before 5.4.0. poi-ooxml 5.4.0 has a check that throws an exception if zip entries with duplicate file names are found in the input file.\nUsers are recommended to upgrade to version poi-ooxml 5.4.0, which fixes the issue. Please read  https://poi.apache.org/security.html  for recommendations about how to use the POI libraries securely.","dates":{"published":"2025-04-09T11:59:33.900Z","modified":"2025-05-23T13:11:07.642Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.3,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":10,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":10,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":10,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":10,"impact":2.3,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Maven","score":6.9,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Maven","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":10,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.01355,"percentile":0.71227,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0.02299999999999993,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.01332},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01355,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01355,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01355,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01355,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01355,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01355,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01355,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01355,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01355,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01355,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.01355,"percentile":0.71227}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01332,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01355,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01355,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01355,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01355,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01355,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01355,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01355,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01355,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01355,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01355,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.01355,"percentile":0.71227}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-20","name":"Improper Input Validation","description":"The product receives input or data, but it does\n        not validate or incorrectly validates that the input has the\n        properties that are required to process the data safely and\n        correctly.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/20.html"}],"affected":[{"vendor":"apache software foundation","product":"apache poi","name":"Apache POI","label":"apache poi","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.4.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.4.0","eol":null,"hubHref":"/vendor/apache_software_foundation/apache_poi"},{"vendor":"apache","product":"poi","name":"poi","label":"poi","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.4.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.4.0","eol":null,"hubHref":"/vendor/apache/poi"},{"vendor":"chainguard","product":"opensearch-2","name":"opensearch-2","label":"opensearch-2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-2-alerting","name":"opensearch-2-alerting","label":"opensearch-2-alerting","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2-alerting","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-2-analysis-icu","name":"opensearch-2-analysis-icu","label":"opensearch-2-analysis-icu","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2-analysis-icu","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-2-analysis-kuromoji","name":"opensearch-2-analysis-kuromoji","label":"opensearch-2-analysis-kuromoji","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2-analysis-kuromoji","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-2-analysis-nori","name":"opensearch-2-analysis-nori","label":"opensearch-2-analysis-nori","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2-analysis-nori","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-2-analysis-phonetic","name":"opensearch-2-analysis-phonetic","label":"opensearch-2-analysis-phonetic","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2-analysis-phonetic","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-2-analysis-smartcn","name":"opensearch-2-analysis-smartcn","label":"opensearch-2-analysis-smartcn","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2-analysis-smartcn","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-2-analysis-stempel","name":"opensearch-2-analysis-stempel","label":"opensearch-2-analysis-stempel","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2-analysis-stempel","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-2-analysis-ukrainian","name":"opensearch-2-analysis-ukrainian","label":"opensearch-2-analysis-ukrainian","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2-analysis-ukrainian","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-2-anomaly-detection","name":"opensearch-2-anomaly-detection","label":"opensearch-2-anomaly-detection","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2-anomaly-detection","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-2-asynchronous-search","name":"opensearch-2-asynchronous-search","label":"opensearch-2-asynchronous-search","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2-asynchronous-search","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-2-cross-cluster-replication","name":"opensearch-2-cross-cluster-replication","label":"opensearch-2-cross-cluster-replication","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2-cross-cluster-replication","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-2-crypto-kms","name":"opensearch-2-crypto-kms","label":"opensearch-2-crypto-kms","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2-crypto-kms","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-2-custom-codecs","name":"opensearch-2-custom-codecs","label":"opensearch-2-custom-codecs","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2-custom-codecs","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-2-discovery-azure-classic","name":"opensearch-2-discovery-azure-classic","label":"opensearch-2-discovery-azure-classic","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2-discovery-azure-classic","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-2-discovery-ec2","name":"opensearch-2-discovery-ec2","label":"opensearch-2-discovery-ec2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2-discovery-ec2","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-2-discovery-gce","name":"opensearch-2-discovery-gce","label":"opensearch-2-discovery-gce","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2-discovery-gce","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-2-entrypoint-compat","name":"opensearch-2-entrypoint-compat","label":"opensearch-2-entrypoint-compat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2-entrypoint-compat","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-2-geospatial","name":"opensearch-2-geospatial","label":"opensearch-2-geospatial","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2-geospatial","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-2-identity-shiro","name":"opensearch-2-identity-shiro","label":"opensearch-2-identity-shiro","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2-identity-shiro","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-2-index-management","name":"opensearch-2-index-management","label":"opensearch-2-index-management","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2-index-management","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-2-ingest-attachment","name":"opensearch-2-ingest-attachment","label":"opensearch-2-ingest-attachment","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2-ingest-attachment","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-2-job-scheduler","name":"opensearch-2-job-scheduler","label":"opensearch-2-job-scheduler","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2-job-scheduler","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-2-k-nn","name":"opensearch-2-k-nn","label":"opensearch-2-k-nn","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2-k-nn","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-2-mapper-annotated-text","name":"opensearch-2-mapper-annotated-text","label":"opensearch-2-mapper-annotated-text","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2-mapper-annotated-text","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-2-mapper-murmur3","name":"opensearch-2-mapper-murmur3","label":"opensearch-2-mapper-murmur3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2-mapper-murmur3","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-2-mapper-size","name":"opensearch-2-mapper-size","label":"opensearch-2-mapper-size","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2-mapper-size","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-2-ml-commons","name":"opensearch-2-ml-commons","label":"opensearch-2-ml-commons","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2-ml-commons","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-2-neural-search","name":"opensearch-2-neural-search","label":"opensearch-2-neural-search","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2-neural-search","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-2-notifications","name":"opensearch-2-notifications","label":"opensearch-2-notifications","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2-notifications","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-2-observability","name":"opensearch-2-observability","label":"opensearch-2-observability","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2-observability","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-2-performance-analyzer","name":"opensearch-2-performance-analyzer","label":"opensearch-2-performance-analyzer","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2-performance-analyzer","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-2-reporting","name":"opensearch-2-reporting","label":"opensearch-2-reporting","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2-reporting","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-2-repository-azure","name":"opensearch-2-repository-azure","label":"opensearch-2-repository-azure","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2-repository-azure","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-2-repository-gcs","name":"opensearch-2-repository-gcs","label":"opensearch-2-repository-gcs","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2-repository-gcs","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-2-repository-s3","name":"opensearch-2-repository-s3","label":"opensearch-2-repository-s3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2-repository-s3","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-2-security","name":"opensearch-2-security","label":"opensearch-2-security","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2-security","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-2-security-analytics","name":"opensearch-2-security-analytics","label":"opensearch-2-security-analytics","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2-security-analytics","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-2-sql","name":"opensearch-2-sql","label":"opensearch-2-sql","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2-sql","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-2-store-smb","name":"opensearch-2-store-smb","label":"opensearch-2-store-smb","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2-store-smb","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-2-telemetry-otel","name":"opensearch-2-telemetry-otel","label":"opensearch-2-telemetry-otel","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2-telemetry-otel","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-2-transport-nio","name":"opensearch-2-transport-nio","label":"opensearch-2-transport-nio","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-2-transport-nio","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"ranger","name":"ranger","label":"ranger","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/ranger","purlType":"apk","versions":[{"text":"< 2.9.0-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.9.0-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"solr-9-full","name":"solr-9-full","label":"solr-9-full","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/solr-9-full","purlType":"apk","versions":[{"text":"< 9.10.1-r16","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.10.1-r16","eol":null,"hubHref":null},{"vendor":"chainguard","product":"solr-fips-9-full","name":"solr-fips-9-full","label":"solr-fips-9-full","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/solr-fips-9-full","purlType":"apk","versions":[{"text":"< 9.10.1-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.10.1-r4","eol":null,"hubHref":null},{"vendor":"wolfi","product":"opensearch-2","name":"opensearch-2","label":"opensearch-2","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/opensearch-2","purlType":"apk","versions":[{"text":"< 2.19.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.1-r2","eol":null,"hubHref":null},{"vendor":"debian","product":"libapache-poi-java","name":"libapache-poi-java","label":"libapache-poi-java","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/libapache-poi-java","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"libapache-poi-java","name":"libapache-poi-java","label":"libapache-poi-java","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/libapache-poi-java","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"org.apache.poi","product":"poi-ooxml","name":"org.apache.poi:poi-ooxml","label":"poi-ooxml","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/org.apache.poi/poi-ooxml","purlType":"maven","versions":[{"text":"< 5.4.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.4.0","eol":null,"hubHref":null},{"vendor":"netapp","product":"active_iq_unified_manager","name":"active iq unified manager","label":"active_iq_unified_manager","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/netapp/active_iq_unified_manager"}],"affectedCount":52,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://bz.apache.org/bugzilla/show_bug.cgi?id=69620","label":"bz.apache.org/bugzilla/show_bug.cgi?id=69620","hostname":"bz.apache.org","tags":["Issue Tracking","REPORT","WEB","Permissions Required"]},{"url":"https://lists.apache.org/thread/k14w8vcjqy4h34hh5kzldko78kpylkq5","label":"lists.apache.org/thread/k14w8vcjqy4h34hh5kzldko78kpylkq5","hostname":"lists.apache.org","tags":["Vendor Advisory","Advisory","WEB","Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2025/04/08/2","label":"www.openwall.com/lists/oss-security/2025/04/08/2","hostname":"www.openwall.com","tags":["WEB","Mailing List","Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20250523-0004/","label":"security.netapp.com/advisory/ntap-20250523-0004/","hostname":"security.netapp.com","tags":["Advisory","Third Party Advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-31672","label":"ubuntu.com/security/CVE-2025-31672","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-31672","label":"www.cve.org/CVERecord?id=CVE-2025-31672","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://www.openwall.com/lists/oss-security/2025/04/08/2","label":"www.openwall.com/lists/oss-security/2025/04/08/2","hostname":"www.openwall.com","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-31672","label":"security-tracker.debian.org/tracker/CVE-2025-31672","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://repo.maven.apache.org/maven2","label":"repo.maven.apache.org/maven2","hostname":"repo.maven.apache.org","tags":["WEB"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31672.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31672.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-31672","label":"nvd.nist.gov/vuln/detail/CVE-2025-31672","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/apache/poi","label":"github.com/apache/poi","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://security.netapp.com/advisory/ntap-20250523-0004","label":"security.netapp.com/advisory/ntap-20250523-0004","hostname":"security.netapp.com","tags":["WEB"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CGA-P724-2W94-MV7H","CGA-W2XQ-PCRG-8JQF"]},"timeline":[{"kind":"published","date":"2025-04-09T11:59:33.900Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-05-23T13:11:07.642Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":21,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T19:15:49.207Z","stale":false,"partial":false}}