docx4j is a JAXB-based Java library for reading and writing Word, PowerPoint, and Excel files, and it sits underneath a great deal of server-side document processing: report generators, conversion pipelines, document management systems, and anything else that accepts a .docx upload and needs to inspect it. CVE-2026-53752, published by the project on 7 July 2026, is an uncontrolled recursion issue in the code that resolves formatting properties.
The defect
WordprocessingML lets a style inherit from another style through the w:basedOn element. To work out the effective formatting of a paragraph or run, docx4j’s PropertyResolver and its related utilities walk that inheritance chain upwards, resolving each parent in turn.
The walk had no cycle detection. A document that declares style A as based on style B and style B as based on style A gives the resolver a chain with no terminus, so it recurses until the thread’s stack is exhausted and a java.lang.StackOverflowError is thrown. Nothing exotic is required to build such a document; the cycle is a handful of bytes in styles.xml, and the file is otherwise a perfectly ordinary Word document that most validators and content-type checks will wave through.
The project classifies the issue as CWE-674 (Uncontrolled Recursion) alongside CWE-770 (Allocation of Resources Without Limits or Throttling), and scores it 7.5 High under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Impact, framed correctly
docx4j is a library, and libraries do not authenticate anything, so it is a category error to call this an “unauthenticated denial of service in docx4j”. What it is, precisely, is a library-level denial of service that propagates into the services that embed it.
The realistic deployment shapes are what make the CVSS vector land where it does. A document conversion endpoint, a resume or invoice ingestion pipeline, a collaboration platform’s preview renderer, or a mail gateway that unpacks attachments are all network-reachable, all commonly accept documents from parties who have not authenticated, and all hand those documents straight to a parser. In that setting AV:N/PR:N is the correct description of the reachable attack surface, and A:H reflects that a single small file can take down the worker handling it. Whether the blast radius is one request or the whole process depends on how the consuming service isolates its parsing work, which is a decision the library cannot make on its behalf.
Anyone running docx4j should upgrade org.docx4j:docx4j-core to 11.5.14 or later. Versions up to and including 11.5.13 are affected.
On the bug class
Recursive descent over attacker-controlled graph structures is one of the more durable sources of availability bugs in document, schema, and markup tooling. The pattern is consistent: a specification permits references between elements, real documents use those references acyclically, the implementation therefore assumes acyclicity, and nothing in the parser enforces it. The same shape shows up in style inheritance, schema references, entity expansion, and template includes, and it survives in mature and well-maintained codebases precisely because the assumption is invisible until someone deliberately violates it.
This finding came out of a broader audit of that bug class across document and specification parsers. Where those reviews produce further confirmed issues, they are being handled on coordinated disclosure timelines with the respective maintainers, and we will write them up here as fixes ship.
We reported this issue privately to the docx4j maintainer, who fixed it in 11.5.14 and credited Isopach for the responsible disclosure in the published advisory.
References
- GitHub Security Advisory: GHSA-gc95-3vw8-vg43
- GitLab Advisory Database: CVE-2026-53752
- Fixed release: docx4j 11.5.14