Org.apache.tika:tika-core

This hub aggregates every CVE we track for Org.apache.tika:tika-core, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 13 most recently published vulnerabilities affecting Org.apache.tika:tika-core.

• CVE-2025-66516Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected8.4Dec 4, 2025
• CVE-2022-30973Missing fix for CVE-2022-30126 in 1.28.25.5May 31, 2022
• CVE-2022-30126Apache Tika Regular Expression Denial of Service in Standards Extractor5.5May 16, 2022
• CVE-2019-10088A carefully crafted or corrupt zip file can cause an OOM in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Users should upgrade to 1.22 or later.8.8Aug 2, 2019
• CVE-2019-10094A carefully crafted package/compressed file that, when unzipped/uncompressed yields the same file (a quine), causes a StackOverflowError in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21...7.8Aug 2, 2019
• CVE-2018-11796In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the ...7.5Oct 9, 2018
• CVE-2018-8017In Apache Tika 1.2 to 1.18, a carefully crafted file can trigger an infinite loop in the IptcAnpaParser.5.5Sep 19, 2018
• CVE-2018-11762In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline (--extract-dir=) and the input file has an embedded file with an absolute path,...5.9Sep 19, 2018
• CVE-2018-11761In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service ...7.5Sep 19, 2018
• CVE-2018-1338A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's BPGParser in versions of Apache Tika before 1.18.5.5Apr 25, 2018
• CVE-2018-1335From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. Thi...8.1Apr 25, 2018
• CVE-2016-4434Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML External Entity (XXE) attacks via vectors involving (1) spr...7.8Sep 29, 2017
• CVE-2016-6809Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. The issue exists because Tika invokes JMatIO to do native deserialization.9.8Apr 6, 2017