- Latest release
- 4.2.0 (Oct 25, 2026): no advisory affects it
- Newest unaffected release
- 4.2.0 (Oct 25, 2026), the latest release
- Advisories
- 13 · 1 high
- Dependents
- 138
- Releases
- 78 since 0.4 (Jul 27, 2009)
- Registry
- Maven Central
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2025-66516Affects 1.13 to 3.2.1 (3.2.2 is outside it)
- CVE-2022-30973Affects 1.17 to 1.28.2 (1.28.3 is outside it)
- CVE-2022-30126Affects 1.17 to 1.28.1 (1.28.2 is outside it); 2.0.0 to 2.3.0 (2.4.0 is outside it)
- CVE-2019-10088Affects 1.7 to 1.21 (1.22 is outside it)
- CVE-2019-10094Affects 1.7 to 1.21 (1.22 is outside it)
- CVE-2018-11796Affects 0.4 to 1.19 (1.19.1 is outside it)
- CVE-2018-8017Affects 1.2 to 1.18 (1.19 is outside it)
- CVE-2018-11762Affects 0.9 to 1.18 (1.19 is outside it)
- CVE-2018-11761Affects 0.4 to 1.19 (1.19.1 is outside it)
- CVE-2018-1338Affects 0.4 to 1.17 (1.18 is outside it)
- CVE-2018-1335Affects 1.7 to 1.17 (1.18 is outside it)
- CVE-2016-4434Affects 0.4 to 1.12 (1.13 is outside it)
- CVE-2016-6809Affects 0.4 to 1.13 (1.14 is outside it)
Advisories 13
- CVE-2025-66516High 8.4
Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected
Affected: from 1.13, through 3.2.1; from 1.13, fixed in 3.2.2.
Fixed in 3.2.2 (released Aug 6, 2025, 120 days before disclosure).
The latest release, 4.2.0, is not affected.
- CVE-2022-30973Unrated
Missing fix for CVE-2022-30126 in 1.28.2
Affected: from 1.17, fixed in 1.28.3.
Fixed in 1.28.3 (released May 23, 2022, 8 days before disclosure).
The latest release, 4.2.0, is not affected.
- CVE-2022-30126Unrated
Apache Tika Regular Expression Denial of Service in Standards Extractor
Affected: from 1.17, fixed in 1.28.2; from 2.0.0, fixed in 2.4.0.
Fixed in 1.28.2 (released Apr 28, 2022, 18 days before disclosure) and 2.4.0 (released Apr 28, 2022, 18 days before disclosure).
The latest release, 4.2.0, is not affected.
- CVE-2019-10088Unrated
A carefully crafted or corrupt zip file can cause an OOM in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21.
Affected: from 1.7, fixed in 1.22.
Fixed in 1.22 (released Jul 29, 2019, 4 days before disclosure).
The latest release, 4.2.0, is not affected.
- CVE-2019-10094Unrated
A carefully crafted package/compressed file that, when unzipped/uncompressed yields the same file (a quine), causes a StackOverflowError…
Affected: from 1.7, fixed in 1.22.
Fixed in 1.22 (released Jul 29, 2019, 4 days before disclosure).
The latest release, 4.2.0, is not affected.
- CVE-2018-11796Unrated
In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing.
Affected: from 0.1, fixed in 1.19.1.
Fixed in 1.19.1 (released Oct 4, 2018, 5 days before disclosure).
The latest release, 4.2.0, is not affected.
- CVE-2018-8017Unrated
In Apache Tika 1.2 to 1.18, a carefully crafted file can trigger an infinite loop in the IptcAnpaParser.
Affected: from 1.2, fixed in 1.19.
Fixed in 1.19 (released Sep 14, 2018, 5 days before disclosure).
The latest release, 4.2.0, is not affected.
- CVE-2018-11762Unrated
In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline (--extract-dir=) and…
Affected: from 0.9, fixed in 1.19.
Fixed in 1.19 (released Sep 14, 2018, 5 days before disclosure).
The latest release, 4.2.0, is not affected.
- CVE-2018-11761Unrated
In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion.
Affected: from 0.1, fixed in 1.19.1.
Fixed in 1.19.1 (released Oct 4, 2018, 15 days after disclosure).
The latest release, 4.2.0, is not affected.
- CVE-2018-1338Unrated
A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's BPGParser in versions of Apache Tika before 1.18.
Affected: fixed in 1.18.
Fixed in 1.18 (released Apr 20, 2018, 5 days before disclosure).
The latest release, 4.2.0, is not affected.
- CVE-2018-1335Unrated
From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands…
Affected: from 1.7, fixed in 1.18.
Fixed in 1.18 (released Apr 20, 2018, 5 days before disclosure).
The latest release, 4.2.0, is not affected.
- CVE-2016-4434Unrated
Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML…
Affected: fixed in 1.13.
Fixed in 1.13 (released May 9, 2016, 508 days before disclosure).
The latest release, 4.2.0, is not affected.
- CVE-2016-6809Unrated
Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files.
Affected: fixed in 1.14.
Fixed in 1.14 (released Oct 19, 2016, 169 days before disclosure).
The latest release, 4.2.0, is not affected.