The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate, new regex DoS in a different regex in the StandardsExtractingContentHandler. These are now fixed in 1.28.4 and 2.4.1.
[
{
"product": "Apache Tika",
"vendor": "Apache Software Foundation",
"versions": [
{
"changes": [
{
"at": "1.28.4",
"status": "unaffected"
}
],
"lessThan": "2.4.1",
"status": "affected",
"version": "Apache Tika",
"versionType": "custom"
}
]
}
]