CVE-2026-53752

docx4j is an open source Java library for creating, editing, and saving OpenXML packages, including DOCX, PPTX, and XLSX files. Prior to 11.5.14, PropertyResolver and adjacent helpers recursively follow the WordprocessingML w:basedOn style inheritance chain without cycle detection. A well-formed...

CVE-2026-53752 docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service

docx4j is an open source Java library for creating, editing, and saving OpenXML packages, including DOCX, PPTX, and XLSX files. Prior to 11.5.14, PropertyResolver and adjacent helpers recursively follow the WordprocessingML w:basedOn style inheritance chain without cycle detection. A well-formed...

EUVD-2026-77696

docx4j is an open source Java library for creating, editing, and saving OpenXML packages, including DOCX, PPTX, and XLSX files. Prior to 11.5.14, PropertyResolver and adjacent helpers recursively follow the WordprocessingML w:basedOn style inheritance chain without cycle detection. A well-formed...

CVE-2026-53752

docx4j is an open source Java library for creating, editing, and saving OpenXML packages, including DOCX, PPTX, and XLSX files. Prior to 11.5.14, PropertyResolver and adjacent helpers recursively follow the WordprocessingML w:basedOn style inheritance chain without cycle detection. A well-formed...

CVE-2026-53752 docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service

docx4j is an open source Java library for creating, editing, and saving OpenXML packages, including DOCX, PPTX, and XLSX files. Prior to 11.5.14, PropertyResolver and adjacent helpers recursively follow the WordprocessingML w:basedOn style inheritance chain without cycle detection. A well-formed...

CVE-2026-53752

docx4j , an open-source Java library for OpenXML processing, is vulnerable to a denial of service via a cyclic w:basedOn style inheritance chain. In versions prior to 11.5.14 , PropertyResolver.fillPPrStack and adjacent helpers recurse through style inheritance without cycle detection. A well-for...

CVE-2026-53752 docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service

docx4j is an open source Java library for creating, editing, and saving OpenXML packages, including DOCX, PPTX, and XLSX files. Prior to 11.5.14, PropertyResolver and adjacent helpers recursively follow the WordprocessingML w:basedOn style inheritance chain without cycle detection. A well-formed...

CVE-2026-53752: Uncontrolled Recursion

docx4j is an open source Java library for creating, editing, and saving OpenXML packages, including DOCX, PPTX, and XLSX files. Prior to 11.5.14, PropertyResolver and adjacent helpers recursively follow the WordprocessingML w:basedOn style inheritance chain without cycle detection. A well-formed...

com.github.paulcwarren:spring-content-docx4j (>=2.1.0, <=2.3.0), org.docx4j:docx4j-conversion-via-microsoft-graph (8.3.4) +9 more potentially affected by CVE-2026-53752 via org.docx4j:docx4j-core (8.3.4)

org.docx4j:docx4j-core MAVEN version 8.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.docx4j:docx4j-core and may be impacted: - com.github.paulcwarren:spring-content-docx4j =2.1.0, =2.3.0 - org.docx4j:docx4j-conversion-via-microsoft-graph 8.3....

hu.blackbelt.bundles.docx4j:org.docx4j (8.3.14_1), org.docx4j:docx4j-bundle (8.3.14) +11 more potentially affected by CVE-2026-53752 via org.docx4j:docx4j-core (8.3.14)

org.docx4j:docx4j-core MAVEN version 8.3.14 is affected by a known vulnerability. The following packages have a transitive dependency on org.docx4j:docx4j-core and may be impacted: - hu.blackbelt.bundles.docx4j:org.docx4j 8.3.141 - org.docx4j:docx4j-bundle 8.3.14 -...

com.alanpoi:alanpoi-all (>=1.3.4, <=3.0.0), com.alanpoi:alanpoi-analysis (>=1.3.4, <=3.0.0) +10 more potentially affected by CVE-2026-53752 via org.docx4j:docx4j-core (8.3.0)

org.docx4j:docx4j-core MAVEN version 8.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.docx4j:docx4j-core and may be impacted: - com.alanpoi:alanpoi-all =1.3.4, =1.3.4, =3.0.0 - org.docx4j:docx4j-conversion-via-microsoft-graph 8.3.0 -...

org.docx4j:docx4j-diffx (8.1.7), org.docx4j:docx4j-docx-anon (8.1.7) +3 more potentially affected by CVE-2026-53752 via org.docx4j:docx4j-core (8.1.7)

org.docx4j:docx4j-core MAVEN version 8.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.docx4j:docx4j-core and may be impacted: - org.docx4j:docx4j-diffx 8.1.7 - org.docx4j:docx4j-docx-anon 8.1.7 - org.docx4j:docx4j-jaxb-internal 8.1.7 -...

docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service

Summary docx4j's PropertyResolver and several adjacent helpers recursively walk the OpenXML style inheritance chain w:basedOn without cycle detection. A WordprocessingML document containing a cyclic style chain for example, Style A based on B and Style B based on A causes unbounded recursion and ...

GHSA-GC95-3VW8-VG43 docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service

Summary docx4j's PropertyResolver and several adjacent helpers recursively walk the OpenXML style inheritance chain w:basedOn without cycle detection. A WordprocessingML document containing a cyclic style chain for example, Style A based on B and Style B based on A causes unbounded recursion and ...

org.docx4j:docx4j-bundle (8.3.10), org.docx4j:docx4j-conversion-via-microsoft-graph (8.3.10) +11 more potentially affected by CVE-2026-53752 via org.docx4j:docx4j-core (8.3.10)

org.docx4j:docx4j-core MAVEN version 8.3.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.docx4j:docx4j-core and may be impacted: - org.docx4j:docx4j-bundle 8.3.10 - org.docx4j:docx4j-conversion-via-microsoft-graph 8.3.10 -...

de.phip1611:docx4j-search-and-replace-util (>=1.0.1, <=1.0.3), org.docx4j:docx4j-conversion-via-microsoft-graph (8.2.3) +9 more potentially affected by CVE-2026-53752 via org.docx4j:docx4j-core (8.2.3)

org.docx4j:docx4j-core MAVEN version 8.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.docx4j:docx4j-core and may be impacted: - de.phip1611:docx4j-search-and-replace-util =1.0.1, =1.0.3 - org.docx4j:docx4j-conversion-via-microsoft-graph 8.2.3 ...

org.docx4j:docx4j-diffx (8.1.4), org.docx4j:docx4j-docx-anon (8.1.4) +4 more potentially affected by CVE-2026-53752 via org.docx4j:docx4j-core (8.1.4)

org.docx4j:docx4j-core MAVEN version 8.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.docx4j:docx4j-core and may be impacted: - org.docx4j:docx4j-diffx 8.1.4 - org.docx4j:docx4j-docx-anon 8.1.4 - org.docx4j:docx4j-export-fo 8.1.4 -...

org.docx4j:docx4j-conversion-via-microsoft-graph (8.2.8), org.docx4j:docx4j-diffx (8.2.8) +9 more potentially affected by CVE-2026-53752 via org.docx4j:docx4j-core (8.2.8)

org.docx4j:docx4j-core MAVEN version 8.2.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.docx4j:docx4j-core and may be impacted: - org.docx4j:docx4j-conversion-via-microsoft-graph 8.2.8 - org.docx4j:docx4j-diffx 8.2.8 -...

org.docx4j:docx4j-diffx (8.2.0), org.docx4j:docx4j-documents4j-local (8.2.0) +7 more potentially affected by CVE-2026-53752 via org.docx4j:docx4j-core (8.2.0)

org.docx4j:docx4j-core MAVEN version 8.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.docx4j:docx4j-core and may be impacted: - org.docx4j:docx4j-diffx 8.2.0 - org.docx4j:docx4j-documents4j-local 8.2.0 - org.docx4j:docx4j-documents4j-remote...

com.vladsch.flexmark:flexmark-docx-converter (>=0.50.24, <=0.61.10), org.docx4j:docx4j-diffx (8.1.2) +5 more potentially affected by CVE-2026-53752 via org.docx4j:docx4j-core (8.1.2)

org.docx4j:docx4j-core MAVEN version 8.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.docx4j:docx4j-core and may be impacted: - com.vladsch.flexmark:flexmark-docx-converter =0.50.24, =0.61.10 - org.docx4j:docx4j-diffx 8.1.2 -...