{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/docx4j-core--11.5.13/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["docx4j-core (\u003c= 11.5.13)"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","library-vulnerability","java"],"_cs_type":"advisory","_cs_vendors":["docx4j"],"content_html":"\u003cp\u003eThe docx4j-core library, specifically versions up to 11.5.13, contains a vulnerability in the \u003ccode\u003ePropertyResolver\u003c/code\u003e class that leads to a \u003ccode\u003ejava.lang.StackOverflowError\u003c/code\u003e when parsing WordprocessingML documents. The issue stems from the library's recursive processing of the \u003ccode\u003ew:basedOn\u003c/code\u003e style inheritance chain without implementing cycle detection. By crafting a DOCX file with cyclic style references, such as Style A inheriting from Style B and Style B inheriting from Style A, an attacker can induce unbounded recursion. This attack pattern triggers immediate thread-stack exhaustion upon processing, which can lead to service degradation or process crashes in server-side applications that utilize docx4j for document transformation, conversion, or content extraction. Because the exploit relies on standard OOXML structure, it often bypasses conventional signature-based file scanners and endpoint security controls.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker prepares a malicious WordprocessingML (.docx) file containing custom XML styles.\u003c/li\u003e\n\u003cli\u003eWithin the document settings, the attacker defines Style A with a \u003ccode\u003ew:basedOn\u003c/code\u003e attribute pointing to Style B.\u003c/li\u003e\n\u003cli\u003eThe attacker defines Style B with a \u003ccode\u003ew:basedOn\u003c/code\u003e attribute pointing back to Style A, creating a circular reference.\u003c/li\u003e\n\u003cli\u003eThe malicious file is uploaded to a target server-side application (e.g., document converter, web portal, or email processor).\u003c/li\u003e\n\u003cli\u003eThe target application passes the document to the vulnerable \u003ccode\u003edocx4j-core\u003c/code\u003e library for rendering or property extraction.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ePropertyResolver\u003c/code\u003e attempts to resolve effective styles by recursively calling \u003ccode\u003efillPPrStack\u003c/code\u003e for the cyclic chain.\u003c/li\u003e\n\u003cli\u003eThe Java Virtual Machine terminates the processing thread due to a \u003ccode\u003ejava.lang.StackOverflowError\u003c/code\u003e caused by the recursion depth.\u003c/li\u003e\n\u003cli\u003eThe application worker thread crashes, potentially leading to resource exhaustion or denial of service for other users.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a denial of service for the document processing pipeline. Observed impact includes the immediate termination of worker threads, which can lead to total service unavailability if the application lacks robust request isolation or thread management. This vulnerability primarily affects enterprise applications in sectors such as document management, legal tech, and collaborative platforms where untrusted DOCX file submission is a core feature. The impact is elevated in environments using containerized or serverless architectures where crashes may trigger frequent, costly restarts or cascading failures across internal dependencies.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003edocx4j-core\u003c/code\u003e to a version that includes a fix for CVE-2026-53752.\u003c/li\u003e\n\u003cli\u003eImplement input validation for uploaded files to detect cyclic \u003ccode\u003ew:basedOn\u003c/code\u003e references within the XML structure of the document before passing them to the rendering engine.\u003c/li\u003e\n\u003cli\u003eExecute document conversion tasks within sandboxed or ephemeral environments that limit the impact of process crashes on the main application.\u003c/li\u003e\n\u003cli\u003eMonitor application logs for \u003ccode\u003ejava.lang.StackOverflowError\u003c/code\u003e exceptions associated with document parsing or transformation modules.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-18T00:46:45Z","date_published":"2026-08-18T00:46:45Z","id":"https://feed.craftedsignal.io/briefs/2026-08-docx4j-dos/","summary":"The docx4j-core library is vulnerable to a stack exhaustion denial-of-service attack due to missing cycle detection in the OpenXML style resolution process.","title":"Denial of Service in docx4j-core via Cyclic Style Inheritance","url":"https://feed.craftedsignal.io/briefs/2026-08-docx4j-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Docx4j-Core (\u003c= 11.5.13)","version":"https://jsonfeed.org/version/1.1"}