Apache Tika
25 CVEs affecting Apache Tika. Latest disclosed: 2025-12-04. Critical: 1, High: 9.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-6809 | Critical | 9.8 | 2017-04-06 | Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. The issue exists because Tika invokes JMatIO to do native d… |
CVE-2019-10088 | High | 8.8 | 2019-08-02 | A carefully crafted or corrupt zip file can cause an OOM in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Users should upgrade to 1.22 or later. |
CVE-2025-66516 | High | 8.4 | 2025-12-04 | Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to… |
CVE-2025-54988 | High | 8.4 | 2025-08-20 | Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML Exter… |
CVE-2018-1335 | High | 8.1 | 2018-04-25 | From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line… |
CVE-2019-10094 | High | 7.8 | 2019-08-02 | A carefully crafted package/compressed file that, when unzipped/uncompressed yields the same file (a quine), causes a StackOverflowError in Apache Tika's Recur… |
CVE-2016-4434 | High | 7.8 | 2017-09-30 | Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML External Entity (XXE)… |
CVE-2021-33813 | High | 7.5 | 2021-06-16 | An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request. |
CVE-2018-11796 | High | 7.5 | 2018-10-09 | In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, w… |
CVE-2018-11761 | High | 7.5 | 2018-09-19 | In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability… |
CVE-2019-10093 | Medium | 6.5 | 2019-08-02 | In Apache Tika 1.19 to 1.21, a carefully crafted 2003ml or 2006ml file could consume all available SAXParsers in the pool and lead to very long hangs. Apache T… |
CVE-2018-17197 | Medium | 6.5 | 2018-12-24 | A carefully crafted or corrupt sqlite file can cause an infinite loop in Apache Tika's SQLite3Parser in versions 1.8-1.19.1 of Apache Tika. |
CVE-2018-11762 | Medium | 5.9 | 2018-09-19 | In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline (--extract-dir=) and the input file has a… |
CVE-2022-30973 | Medium | 5.5 | 2022-05-31 | We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the 1.28.2 release. In Apache Tika, a regular expression in the StandardsText class, used by… |
CVE-2022-30126 | Medium | 5.5 | 2022-05-16 | In Apache Tika, a regular expression in our StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by back… |
CVE-2022-25169 | Medium | 5.5 | 2022-05-16 | The BPG parser in versions of Apache Tika before 1.28.2 and 2.4.0 may allocate an unreasonable amount of memory on carefully crafted files. |
CVE-2021-28657 | Medium | 5.5 | 2021-03-31 | A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should upgrade to 1.26 or… |
CVE-2020-9489 | Medium | 5.5 | 2020-04-27 | A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or i… |
CVE-2020-1951 | Medium | 5.5 | 2020-03-23 | A carefully crafted or corrupt PSD file can cause an infinite loop in Apache Tika's PSDParser in versions 1.0-1.23. |
CVE-2020-1950 | Medium | 5.5 | 2020-03-23 | A carefully crafted or corrupt PSD file can cause excessive memory usage in Apache Tika's PSDParser in versions 1.0-1.23. |