CVE-2016-6809

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 8.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-04-06 · updated 2026-06-17
Weakness: CWE-502

Description

Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. The issue exists because Tika invokes JMatIO to do native deserialization.

Affected products

Apache Software Foundation Apache Nutch: 2.3.1
Apache Software Foundation Apache Tika: through 1.13

References

http://seclists.org/bugtraq/2016/Nov/40
http://www.securityfocus.com/bid/94247
https://dist.apache.org/repos/dist/release/tika/CHANGES-1.14.txt
https://lists.apache.org/thread.html/91eb639ef619b9a26b40020ca6732e7dbe457f7322ed5f1df49e411a%40%3Cdev.nutch.apache.org%3E
https://lists.apache.org/thread.html/d2375da29d89e679abf5d845db76d6f798fdc6f7d44f2c788e8a0fb9%40%3Cuser.nutch.apache.org%3E
https://lists.apache.org/thread.html/e414754a6c57ce7194b731e211cd6b2cbb41f2c7000e3fb9c6b6ec78%40%3Cdev.lucene.apache.org%3E
https://lists.apache.org/thread.html/r2f6f6c130b12b7332f323f74d031072b1517065ce28a22346791ffb6%40%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/rfd3646bb724b66b1a9ddef69e692da2b7a727a8799551c78eedf0a0f%40%3Cissues.lucene.apache.org%3E
http://seclists.org/bugtraq/2016/Nov/40
http://www.securityfocus.com/bid/94247
https://dist.apache.org/repos/dist/release/tika/CHANGES-1.14.txt
https://lists.apache.org/thread.html/91eb639ef619b9a26b40020ca6732e7dbe457f7322ed5f1df49e411a%40%3Cdev.nutch.apache.org%3E

Get alerted when CVE-2016-6809 or the next vulnerability affects your stack