# org.apache.tika:tika-core (Maven) vulnerabilities 13 known vulnerabilities (1 high), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 4.2.0 (Oct 25, 2026): no advisory affects it - Newest unaffected release: 4.2.0 (Oct 25, 2026), the latest release - Dependents: 138 - Releases: 78 since 0.4 (Jul 27, 2009) - Registry: https://central.sonatype.com/artifact/org.apache.tika/tika-core - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2025-66516: 1.13 to 3.2.1 (3.2.2 is outside it) - CVE-2022-30973: 1.17 to 1.28.2 (1.28.3 is outside it) - CVE-2022-30126: 1.17 to 1.28.1 (1.28.2 is outside it); 2.0.0 to 2.3.0 (2.4.0 is outside it) - CVE-2019-10088: 1.7 to 1.21 (1.22 is outside it) - CVE-2019-10094: 1.7 to 1.21 (1.22 is outside it) - CVE-2018-11796: 0.4 to 1.19 (1.19.1 is outside it) - CVE-2018-8017: 1.2 to 1.18 (1.19 is outside it) - CVE-2018-11762: 0.9 to 1.18 (1.19 is outside it) - CVE-2018-11761: 0.4 to 1.19 (1.19.1 is outside it) - CVE-2018-1338: 0.4 to 1.17 (1.18 is outside it) - CVE-2018-1335: 1.7 to 1.17 (1.18 is outside it) - CVE-2016-4434: 0.4 to 1.12 (1.13 is outside it) - CVE-2016-6809: 0.4 to 1.13 (1.14 is outside it) ## Advisories (13) ### [CVE-2025-66516](https://cve.now/CVE-2025-66516): Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected - Severity: High 8.4 - Published: Dec 4, 2025 - Affected: from 1.13, through 3.2.1; from 1.13, fixed in 3.2.2. - Fixed in 3.2.2 (released Aug 6, 2025, 120 days before disclosure). - The latest release, 4.2.0, is not affected. ### [CVE-2022-30973](https://cve.now/CVE-2022-30973): Missing fix for CVE-2022-30126 in 1.28.2 - Severity: Unrated - Published: May 31, 2022 - Affected: from 1.17, fixed in 1.28.3. - Fixed in 1.28.3 (released May 23, 2022, 8 days before disclosure). - The latest release, 4.2.0, is not affected. ### [CVE-2022-30126](https://cve.now/CVE-2022-30126): Apache Tika Regular Expression Denial of Service in Standards Extractor - Severity: Unrated - Published: May 16, 2022 - Affected: from 1.17, fixed in 1.28.2; from 2.0.0, fixed in 2.4.0. - Fixed in 1.28.2 (released Apr 28, 2022, 18 days before disclosure) and 2.4.0 (released Apr 28, 2022, 18 days before disclosure). - The latest release, 4.2.0, is not affected. ### [CVE-2019-10088](https://cve.now/CVE-2019-10088): A carefully crafted or corrupt zip file can cause an OOM in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. - Severity: Unrated - Published: Aug 2, 2019 - Affected: from 1.7, fixed in 1.22. - Fixed in 1.22 (released Jul 29, 2019, 4 days before disclosure). - The latest release, 4.2.0, is not affected. ### [CVE-2019-10094](https://cve.now/CVE-2019-10094): A carefully crafted package/compressed file that, when unzipped/uncompressed yields the same file (a quine), causes a StackOverflowError… - Severity: Unrated - Published: Aug 2, 2019 - Affected: from 1.7, fixed in 1.22. - Fixed in 1.22 (released Jul 29, 2019, 4 days before disclosure). - The latest release, 4.2.0, is not affected. ### [CVE-2018-11796](https://cve.now/CVE-2018-11796): In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. - Severity: Unrated - Published: Oct 9, 2018 - Affected: from 0.1, fixed in 1.19.1. - Fixed in 1.19.1 (released Oct 4, 2018, 5 days before disclosure). - The latest release, 4.2.0, is not affected. ### [CVE-2018-8017](https://cve.now/CVE-2018-8017): In Apache Tika 1.2 to 1.18, a carefully crafted file can trigger an infinite loop in the IptcAnpaParser. - Severity: Unrated - Published: Sep 19, 2018 - Affected: from 1.2, fixed in 1.19. - Fixed in 1.19 (released Sep 14, 2018, 5 days before disclosure). - The latest release, 4.2.0, is not affected. ### [CVE-2018-11762](https://cve.now/CVE-2018-11762): In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline (--extract-dir=) and… - Severity: Unrated - Published: Sep 19, 2018 - Affected: from 0.9, fixed in 1.19. - Fixed in 1.19 (released Sep 14, 2018, 5 days before disclosure). - The latest release, 4.2.0, is not affected. ### [CVE-2018-11761](https://cve.now/CVE-2018-11761): In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. - Severity: Unrated - Published: Sep 19, 2018 - Affected: from 0.1, fixed in 1.19.1. - Fixed in 1.19.1 (released Oct 4, 2018, 15 days after disclosure). - The latest release, 4.2.0, is not affected. ### [CVE-2018-1338](https://cve.now/CVE-2018-1338): A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's BPGParser in versions of Apache Tika before 1.18. - Severity: Unrated - Published: Apr 25, 2018 - Affected: fixed in 1.18. - Fixed in 1.18 (released Apr 20, 2018, 5 days before disclosure). - The latest release, 4.2.0, is not affected. ### [CVE-2018-1335](https://cve.now/CVE-2018-1335): From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands… - Severity: Unrated - Published: Apr 25, 2018 - Affected: from 1.7, fixed in 1.18. - Fixed in 1.18 (released Apr 20, 2018, 5 days before disclosure). - The latest release, 4.2.0, is not affected. ### [CVE-2016-4434](https://cve.now/CVE-2016-4434): Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML… - Severity: Unrated - Published: Sep 29, 2017 - Affected: fixed in 1.13. - Fixed in 1.13 (released May 9, 2016, 508 days before disclosure). - The latest release, 4.2.0, is not affected. ### [CVE-2016-6809](https://cve.now/CVE-2016-6809): Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. - Severity: Unrated - Published: Apr 6, 2017 - Affected: fixed in 1.14. - Fixed in 1.14 (released Oct 19, 2016, 169 days before disclosure). - The latest release, 4.2.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.apache.tika:tika-core Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.