Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache Tika

15 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.5
    CVE-2018-11796

    Apache Tika is vulnerable to entity expansions which can lead to a denial of service attack

    In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and …

    Apache Software Foundation Apache Tika tika org.apache.tika:tika-core Ubuntu Maven
  • High 7.5
    CVE-2018-11761 Public exploit

    High severity vulnerability that affects org.apache.tika:tika-core

    In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.

    Apache Software Foundation Apache Tika tika tika Debian Ubuntu Maven
  • High 8.1
    CVE-2018-1335 Public exploit EPSS 94%

    Command injection in org.apache.tika:tika-core

    From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a se…

    Apache Software Foundation Apache Tika tika tika Debian Ubuntu Maven