MavenPackage

org.apache.tika:tika-parsers

5 known vulnerabilities (2 high), with the versions each affects and the releases that fix them.

Latest release: 4.2.0 (Oct 25, 2026): no advisory affects it
Newest unaffected release: 4.2.0 (Oct 25, 2026), the latest release
Advisories: 5 · 2 high

Dependents: 12
Releases: 78 since 0.4 (Jul 27, 2009)
Registry: Maven Central
Releases read: Nov 8, 2026

Version timeline

CVE-2025-66516
Affects 1.13 to 2.0.0-BETA (2.0.0 is outside it)
CVE-2025-54988
Affects 1.13 to 1.28.5 (2.0.0-ALPHA is outside it)
CVE-2019-10093
Affects 1.19 to 1.21 (1.22 is outside it)
CVE-2018-17197
Affects 1.8 to 1.19.1 (1.20 is outside it)
CVE-2018-1339
Affects 0.4 to 1.17 (1.18 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 5

CVE-2025-66516High 8.4
Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected
Affected: from 1.13, fixed in 2.0.0; from 1.13, fixed in 2.0.0.
Fixed in 2.0.0 (released Jul 14, 2021, 1604 days before disclosure).
The latest release, 4.2.0, is not affected.
CVE-2025-54988High 8.4
Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFA
Affected: from 1.13, fixed in 2.0.0-ALPHA.
Fixed in 2.0.0-ALPHA (released Jan 13, 2021, 1680 days before disclosure).
The latest release, 4.2.0, is not affected.
CVE-2019-10093Unrated
In Apache Tika 1.19 to 1.21, a carefully crafted 2003ml or 2006ml file could consume all available SAXParsers in the pool and lead to very…
Affected: from 1.19, fixed in 1.22.
Fixed in 1.22 (released Jul 29, 2019, 4 days before disclosure).
The latest release, 4.2.0, is not affected.
CVE-2018-17197Unrated
A carefully crafted or corrupt sqlite file can cause an infinite loop in Apache Tika's SQLite3Parser in versions 1.8-1.19.1 of Apache Tika.
Affected: from 1.8, fixed in 1.20.
Fixed in 1.20 (released Dec 18, 2018, 6 days before disclosure).
The latest release, 4.2.0, is not affected.
CVE-2018-1339Unrated
A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's ChmParser in versions of Apache Tika before 1.18.
Affected: fixed in 1.18.
Fixed in 1.18 (released Apr 20, 2018, 5 days before disclosure).
The latest release, 4.2.0, is not affected.