CVE-2022-30973 — Missing fix for CVE-2022-30126 in 1.28.2

Description

We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the 1.28.2 release. In Apache Tika, a regular expression in the StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler. This is fixed in 1.28.3.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache Tika	Apache Tika – ≤ 1.28.2	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 26.10	tika	No fix yet	—
Ubuntu 26.04 LTS	tika	No fix yet	—
Ubuntu 25.10	tika	No fix yet	—
Ubuntu 24.04 LTS	tika	No fix yet	—
Ubuntu 18.04 LTS	tika	No fix yet	—

Show 3 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu 16.04 LTS	tika	No fix yet	—
Ubuntu Pro 22.04 LTS	tika	1.22-2ubuntu0.22.04.1~esm1	USN-7529-1
Ubuntu Pro 20.04 LTS	tika	1.22-1ubuntu0.1~esm1	USN-7529-1

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SUSE Manager Server Module 4.2	tika-core	1.26-150300.4.3.1	SUSE-SU-2022:3310-1
SUSE Manager Server Module 4.1	tika-core	1.26-150200.3.8.1	SUSE-SU-2022:3311-1

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.apache.tika:tika-core	>= 1.17, < 1.28.3	1.28.3	GHSA-qw3f-w4pf-jh5f

Advisories 3

USN-7529-1 tika vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
SUSE-SU-2022:3311-1 Security update for tika-core SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:3310-1 Security update for tika-core SUSE / openSUSE Security Updates · May 2, 2025

Missing fix for CVE-2022-30126 in 1.28.2