Skip to content
OpenAdvisories

Package · Maven

org.apache.tika:tika-core

13 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 8.4
    CVE-2025-66516 Public exploit Scanner template EPSS 89%

    Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected

    Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. This CVE covers the…

    Apache Software Foundation Apache Tika PDF parser module Apache Tika core Apache Tika parsers Debian Ubuntu Wolfi Maven
  • High 8.8
    CVE-2019-10088

    Allocation of Resources Without Limits or Throttling in Apache Tika

    A carefully crafted or corrupt zip file can cause an OOM in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Users should upgrade to 1.22 or later.

    Apache Apache Tika tika org.apache.tika:tika-core Debian Maven
  • High 7.8
    CVE-2019-10094

    Allocation of Resources Without Limits or Throttling in Apache Tika

    A carefully crafted package/compressed file that, when unzipped/uncompressed yields the same file (a quine), causes a StackOverflowError in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Apache Tika users should upgrade to 1.22 or later.

    Apache Apache Tika tika org.apache.tika:tika-core Debian Maven
  • High 7.5
    CVE-2018-11796

    Apache Tika is vulnerable to entity expansions which can lead to a denial of service attack

    In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and …

    Apache Software Foundation Apache Tika tika org.apache.tika:tika-core Ubuntu Maven
  • High 7.5
    CVE-2018-11761 Public exploit

    High severity vulnerability that affects org.apache.tika:tika-core

    In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.

    Apache Software Foundation Apache Tika tika tika Debian Ubuntu Maven
  • High 8.1
    CVE-2018-1335 Public exploit Scanner template EPSS 94%

    Command injection in org.apache.tika:tika-core

    From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a se…

    Apache Software Foundation Apache Tika tika tika Debian Ubuntu Maven
  • High 7.8
    CVE-2016-4434

    Apache Tika does not properly initialize the XML parser or choose handlers

    Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML External Entity (XXE) attacks via vectors involving (1) spreadsheets in OOXML files and (2) XMP metadata in PDF and other…

    tika tika org.apache.tika:tika-core Debian Ubuntu Maven