Apache Tika (Apache Software Foundation) - vulnerabilities (CVEs)
15 CVEs, 0 in the last 30 days, 1 known versions, newest CVE from 2026-07-30. Vendor: Apache Software Foundation.
CVEs of Apache Tika
- CVE-2026-66756 - CVSS 9.8 (critical), 2026-07-30: Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1. Users are…
- CVE-2026-66755 - CVSS 7.5 (high), 2026-07-30: Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1, allows an attacker who can…
- CVE-2022-33879 - CVSS 3.3 (low), 2022-06-27: The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate, new…
- CVE-2022-30973 - CVSS 5.5 (medium), 2022-05-31: We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the 1.28.2 release. In Apache Tika, a regular expression in the StandardsText class, used…
- CVE-2022-30126 - CVSS 5.5 (medium), 2022-05-16: In Apache Tika, a regular expression in our StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by…
- CVE-2022-25169 - CVSS 5.5 (medium), 2022-05-16: The BPG parser in versions of Apache Tika before 1.28.2 and 2.4.0 may allocate an unreasonable amount of memory on carefully crafted files.
- CVE-2021-28657 - CVSS 5.5 (medium), 2021-03-31: A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should upgrade to 1.26…
- CVE-2018-17197 - CVSS 6.5 (medium), 2018-12-24: A carefully crafted or corrupt sqlite file can cause an infinite loop in Apache Tika's SQLite3Parser in versions 1.8-1.19.1 of Apache Tika.
- CVE-2018-11796 - CVSS 7.5 (high), 2018-10-09: In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse,…
- CVE-2018-8017 - CVSS 5.5 (medium), 2018-09-19: In Apache Tika 1.2 to 1.18, a carefully crafted file can trigger an infinite loop in the IptcAnpaParser.
- CVE-2018-11762 - CVSS 5.9 (medium), 2018-09-19: In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline (--extract-dir=) and the input file has…
- CVE-2018-11761 - CVSS 7.5 (high), 2018-09-19: In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability…
- CVE-2018-1338 - CVSS 5.5 (medium), 2018-04-25: A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's BPGParser in versions of Apache Tika before 1.18.
- CVE-2018-1335 - CVSS 8.1 (high), 2018-04-25: From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line…
- CVE-2018-1339 - CVSS 5.5 (medium), 2018-04-25: A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's ChmParser in versions of Apache Tika before 1.18.
