Apache tika

This hub aggregates every CVE we track for Apache tika, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Apache tika.

• CVE-2022-33879Incomplete fix and new regex DoS in StandardsExtractingContentHandler3.3Jun 27, 2022
• CVE-2022-30973Missing fix for CVE-2022-30126 in 1.28.25.5May 31, 2022
• CVE-2022-30126Apache Tika Regular Expression Denial of Service in Standards Extractor5.5May 16, 2022
• CVE-2022-25169Apache Tika BPGParser Memory Usage DoS5.5May 16, 2022
• CVE-2021-28657Infinite loop in Apache Tika's MP3 parser5.5Mar 31, 2021
• CVE-2020-9489A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or infinite loops in Tika's ICNSParser, MP...5.5Apr 27, 2020
• CVE-2020-1950A carefully crafted or corrupt PSD file can cause excessive memory usage in Apache Tika's PSDParser in versions 1.0-1.23.5.5Mar 23, 2020
• CVE-2019-10088A carefully crafted or corrupt zip file can cause an OOM in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Users should upgrade to 1.22 or later.8.8Aug 2, 2019
• CVE-2019-10094A carefully crafted package/compressed file that, when unzipped/uncompressed yields the same file (a quine), causes a StackOverflowError in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21...7.8Aug 2, 2019
• CVE-2019-10093In Apache Tika 1.19 to 1.21, a carefully crafted 2003ml or 2006ml file could consume all available SAXParsers in the pool and lead to very long hangs. Apache Tika users should upgrade to 1.22 or la...6.5Aug 2, 2019
• CVE-2018-17197A carefully crafted or corrupt sqlite file can cause an infinite loop in Apache Tika's SQLite3Parser in versions 1.8-1.19.1 of Apache Tika.6.5Dec 24, 2018
• CVE-2018-11796In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the ...7.5Oct 9, 2018
• CVE-2018-8017In Apache Tika 1.2 to 1.18, a carefully crafted file can trigger an infinite loop in the IptcAnpaParser.5.5Sep 19, 2018
• CVE-2018-11762In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline (--extract-dir=) and the input file has an embedded file with an absolute path,...5.9Sep 19, 2018
• CVE-2018-11761In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service ...7.5Sep 19, 2018