Apache Tika
Approved changes feed: RSS · Atom
cpe:2.3:a:apache_software_foundation:apache_tika:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Apache Software Foundation (f563070d-e18f-561b-b86c-987936937e8a) |
|---|---|
| Product | Apache Tika (3968206b-c822-5569-aa30-288214df27f2) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-66755 |
vulnerable | 2026-09-16 04:32:55.237763 |
Apache Tika: Arbitrary Local File Read in ISArchiveParser
Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1, allows an attacker who can place files in a directory that the application subsequently parses to read arbitrary files accessible to the Tika process and have their contents emitted into the extracted text output, via a "Study Assay File Name" value in the ISA-Tab investigation file that traverses outside the dataset directory. Users are recommended to upgrade to version 3.3.2 or 4.0.0-beta-1, which fixes this issue.
Published: 2026-07-30T19:16:42.370Z
Updated: 2026-09-01T12:05:18.862Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-66756 |
vulnerable | 2026-09-16 04:32:54.826896 |
Apache Tika: unpack endpoint in tika-server allows configuration with unsecureFeatures=false
Improper Protection of Alternate Path vulnerability in Apache Tika.
This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1.
Users are recommended to upgrade to version 4.0.0-beta-1, which fixes the issue.
Published: 2026-07-30T19:18:07.900Z
Updated: 2026-07-30T19:33:01.657Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-33879 |
vulnerable | 2026-06-08 05:44:51.287488 |
Incomplete fix and new regex DoS in StandardsExtractingContentHandler
The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate, new regex DoS in a different regex in the StandardsExtractingContentHandler. These are now fixed in 1.28.4 and 2.4.1.
Published: 2022-06-27T21:40:10.000Z
Updated: 2024-08-03T08:09:22.671Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-30973 |
vulnerable | 2026-06-08 05:43:39.905407 |
Missing fix for CVE-2022-30126 in 1.28.2
We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the 1.28.2 release. In Apache Tika, a regular expression in the StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler. This is fixed in 1.28.3.
Published: 2022-05-31T13:20:10.000Z
Updated: 2024-08-03T07:03:40.228Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-30126 |
vulnerable | 2026-06-08 05:43:36.998954 |
Apache Tika Regular Expression Denial of Service in Standards Extractor
In Apache Tika, a regular expression in our StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler. This is fixed in 1.28.2 and 2.4.0
Published: 2022-05-16T17:05:13.000Z
Updated: 2024-08-03T06:40:47.590Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-25169 |
vulnerable | 2026-06-08 05:41:45.472130 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-28657 |
vulnerable | 2026-06-08 05:31:24.694454 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-8017 |
vulnerable | 2026-06-08 05:12:04.995114 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-1339 |
vulnerable | 2026-06-08 05:11:17.760432 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-1338 |
vulnerable | 2026-06-08 05:11:17.760096 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-1335 |
vulnerable | 2026-06-08 05:11:17.739405 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-17197 |
vulnerable | 2026-06-08 05:11:06.143121 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-11796 |
vulnerable | 2026-06-08 05:10:39.040779 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-11762 |
vulnerable | 2026-06-08 05:10:38.918169 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-11761 |
vulnerable | 2026-06-08 05:10:38.915640 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.