A carefully crafted or corrupt zip file can cause an OOM in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Users should upgrade to 1.22 or later.
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HApache Tika
APPApache1.7 – 1.21
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
CWE
References
Related vulnerabilities
CVE-2016-6809CRITICAL9.8PL ✓same product
Apache Tika: RCE przez deserializację obiektów w plikach MATLAB
CVE-2025-66516HIGH8.4same product
Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28....
CVE-2025-54988HIGH8.4same product
Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all pl...
CVE-2021-33813HIGH7.5same product
An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted H...
CVE-2019-10094HIGH7.8same product
A carefully crafted package/compressed file that, when unzipped/uncompressed yields the same file (a quine), c...