Apache Software Foundation Apache Tika vulnerabilities

27 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Latest Apache Software Foundation Apache Tika vulnerabilities

CVE-2026-66756 — Apache Tika: unpack endpoint in tika-server allows configuration with unsecureFeatures=false (CVSS 9.8)
CVE-2026-66755 — Apache Tika: Arbitrary Local File Read in ISArchiveParser (CVSS 7.5)
CVE-2025-66516 — Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected (CVSS 9.8)
CVE-2025-54988 — Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFA (CVSS 8.4)
CVE-2022-33879 — Incomplete fix and new regex DoS in StandardsExtractingContentHandler (CVSS 3.3)
CVE-2022-30973 — Missing fix for CVE-2022-30126 in 1.28.2 (CVSS 5.5)
CVE-2022-30126 — Apache Tika Regular Expression Denial of Service in Standards Extractor (CVSS 5.5)
CVE-2022-25169 — Apache Tika BPGParser Memory Usage DoS (CVSS 5.5)
CVE-2021-33813 — (CVSS 7.5)
CVE-2021-28657 — Infinite loop in Apache Tika's MP3 parser (CVSS 5.5)
CVE-2020-9489 — (CVSS 5.5)
CVE-2020-1951 — (CVSS 5.5)
CVE-2020-1950 — (CVSS 5.5)
CVE-2019-10094 — (CVSS 7.8)
CVE-2019-10093 — (CVSS 6.5)
CVE-2019-10088 — (CVSS 8.8)
CVE-2018-17197 — (CVSS 6.5)
CVE-2018-11796 — (CVSS 7.5)
CVE-2018-8017 — (CVSS 5.5)
CVE-2018-11762 — (CVSS 5.9)
CVE-2018-11761 — (CVSS 7.5)
CVE-2018-1339 — (CVSS 5.5)
CVE-2018-1338 — (CVSS 5.5)
CVE-2018-1335 — (CVSS 8.1)
CVE-2016-4434 — (CVSS 7.8)