High DLA-4350-1 2 CVEs

tika - security update

Published Oct 26, 2025 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

Release	Package	Fixed in
Debian · 11	tika	1.22-2+deb11u1

Vulnerabilities 2

High 8.4

CVE-2025-54988 Public exploit Scanner template EPSS 36%

Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFA

Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensiti…

Apache Software Foundation Apache Tika PDF parser module opensearch-2 opensearch-3 Debian Ubuntu Wolfi Maven

Aug 20, 2025
High 8.4

CVE-2025-66516 Public exploit Scanner template EPSS 89%

Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected

Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. This CVE covers the…

Apache Software Foundation Apache Tika PDF parser module Apache Tika parsers Apache Tika core Debian Ubuntu Wolfi Maven

Dec 4, 2025