CVE-2025-66516

>= 1.13 and < 3.2.2

Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all pl

8.4HIGH

CVE-2025-54988

>= 1.13 and < 3.2.2

Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an at

8.4HIGH

CVE-2022-33879

< 1.28.4

The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and

3.3LOW

CVE-2022-30973

< 1.28.3

We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the 1.28.2 release. In Apache Tika, a regular expression in the

5.5MEDIUM

CVE-2022-30126

< 1.28.3

In Apache Tika, a regular expression in our StandardsText class, used by the StandardsExtractingContentHandler could lead to a den

5.5MEDIUM

CVE-2022-25169

< 1.28.2

The BPG parser in versions of Apache Tika before 1.28.2 and 2.4.0 may allocate an unreasonable amount of memory on carefully craft

5.5MEDIUM

CVE-2021-33813

all versions

An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request.

7.5HIGH

CVE-2021-28657

<= 1.25

A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika us

5.5MEDIUM

CVE-2020-9489

all versions

A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause

5.5MEDIUM

CVE-2020-1951

>= 1.0 and <= 1.23

A carefully crafted or corrupt PSD file can cause an infinite loop in Apache Tika's PSDParser in versions 1.0-1.23.

5.5MEDIUM

CVE-2020-1950

>= 1.0 and <= 1.23

A carefully crafted or corrupt PSD file can cause excessive memory usage in Apache Tika's PSDParser in versions 1.0-1.23.

5.5MEDIUM

CVE-2019-10094

>= 1.7 and <= 1.21

A carefully crafted package/compressed file that, when unzipped/uncompressed yields the same file (a quine), causes a StackOverflo

7.8HIGH

CVE-2019-10093

>= 1.19 and <= 1.21

In Apache Tika 1.19 to 1.21, a carefully crafted 2003ml or 2006ml file could consume all available SAXParsers in the pool and lead

6.5MEDIUM

CVE-2019-10088

>= 1.7 and <= 1.21

A carefully crafted or corrupt zip file can cause an OOM in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Users shoul

8.8HIGH

CVE-2018-17197

>= 1.8 and <= 1.19.1

A carefully crafted or corrupt sqlite file can cause an infinite loop in Apache Tika's SQLite3Parser in versions 1.8-1.19.1 of Apa

6.5MEDIUM

CVE-2018-11796

>= 0.1 and <= 1.19

In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and call

7.5HIGH

CVE-2018-8017

>= 1.2 and <= 1.18

In Apache Tika 1.2 to 1.18, a carefully crafted file can trigger an infinite loop in the IptcAnpaParser.

5.5MEDIUM

CVE-2018-11762

>= 0.9 and <= 1.18

In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline (--extract-d

5.9MEDIUM

CVE-2018-11761

>= 0.1 and <= 1.18

In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an en

7.5HIGH

CVE-2018-1339

< 1.18

A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's ChmParser in versions of Apache Tika before 1.1

5.5MEDIUM

CVE-2018-1338

< 1.18

A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's BPGParser in versions of Apache Tika before 1.1

5.5MEDIUM

CVE-2018-1335

< 1.18

From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject co

8.1HIGH

CVE-2016-4434

all versions

Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to cond

7.8HIGH

CVE-2016-6809

<= 1.13

Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. The issue exists because Tika

9.8CRITICAL

CVE-2015-3271

all versions

Apache Tika server (aka tika-server) in Apache Tika 1.9 might allow remote attackers to read arbitrary files via the HTTP fileUrl

5.3MEDIUM