A carefully crafted or corrupt zip file can cause an OOM in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Users should upgrade to 1.22 or later.
oryginał ENCVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HApache Tika
APPApache1.7 – 1.21
🟢
PATCH DOSTĘPNY
Aktualizacja od producenta gotowa. Wdrożenie w ramach standardowego cyklu.
CWE
Referencje
Powiązane podatności
CVE-2016-6809CRITICAL9.8PL ✓ten sam produkt
Apache Tika: RCE przez deserializację obiektów w plikach MATLAB
CVE-2025-66516HIGH8.4ten sam produkt
Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28....
CVE-2025-54988HIGH8.4ten sam produkt
Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all pl...
CVE-2021-33813HIGH7.5ten sam produkt
An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted H...
CVE-2019-10094HIGH7.8ten sam produkt
A carefully crafted package/compressed file that, when unzipped/uncompressed yields the same file (a quine), c...