TI
Product
Tika
27
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 9Medium 14Low 1
Watch
Add Tika to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-10088 | 8.8 | Aug 2 | A carefully crafted or corrupt zip file can cause an OOM in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21 Affected: 1.7 through 1.21 |
| CVE-2025-54988 | 8.4 | Aug 20 | Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection… Affected: 1.13 before 3.2.2 |
| CVE-2018-1335 | 8.1 | Apr 25 | From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server… Affected: before 1.18 |
| CVE-2019-10094 | 7.8 | Aug 2 | A carefully crafted package/compressed file that, when unzipped/uncompressed yields the same file (a quine), causes a StackOverflowError in Apache Tika's RecursiveParserWrapper in… Affected: 1.7 through 1.21 |
| CVE-2016-4434 | 7.8 | Sep 30 | Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML External Entity (XXE) attacks via vectors… Affected: 1.12 |
| CVE-2026-66755 | 7.5 | Jul 30 | Apache Tika: Arbitrary Local File Read in ISArchiveParser Affected: 1.8 before 3.3.2; 4.0.0; 4.0.0 |
| CVE-2021-33813 | 7.5 | Jun 16 | An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request Affected: 1.25 |
| CVE-2018-11796 | 7.5 | Oct 9 | In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing Affected: 0.1 through 1.19 |
| CVE-2018-11761 | 7.5 | Sep 19 | In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion Affected: 0.1 through 1.18 |
Showing 9