Allocation of Resources Without Limits or Throttling in Apache Tika

In Apache Tika 1.19 to 1.21, a carefully crafted 2003ml or 2006ml file could consume all available SAXParsers in the pool and lead to very long hangs. Apache Tika users should upgrade to 1.22 or later...

CVE-2019-10093

In Apache Tika 1.19 to 1.21, a carefully crafted 2003ml or 2006ml file could consume all available SAXParsers in the pool and lead to very long hangs. Apache Tika users should upgrade to 1.22 or later...

CVE-2019-10093

CVE-2019-10093 affects Apache Tika 1.19–1.21, where parsing carefully crafted 2003ml/2006ml files can exhaust SAXParsers in the pool and cause very long hangs. Impact described as denial of service with availability risk; recommended fix is upgrade to Tika 1.22 or newer. Connected sources also no...

CVE-2019-10093

In Apache Tika 1.19 to 1.21, a carefully crafted 2003ml or 2006ml file could consume all available SAXParsers in the pool and lead to very long hangs. Apache Tika users should upgrade to 1.22 or later...

PT-2019-4680

Name of the Vulnerable Software and Affected Versions Apache Tika versions 1.19 through 1.21 Description The issue is related to an uncontrolled resource consumption in Apache Tika. A carefully crafted 2003ml or 2006ml file could consume all available SAXParsers in the pool, leading to very long...

CVE-2019-10093: Allocation of Resources Without Limits or Throttling

In Apache Tika 1.19 to 1.21, a carefully crafted 2003ml or 2006ml file could consume all available SAXParsers in the pool and lead to very long hangs. Apache Tika users should upgrade to 1.22 or later...

CVE-2018-11796: Improper Restriction of XML External Entity Reference

In Apache Tika 1.19 CVE-2018-11761, we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and thus removes entity expansion limits after...

PT-2018-10826

Name of the Vulnerable Software and Affected Versions Apache Tika versions 0.1 through 1.19 Description The issue concerns entity expansion limits for XML parsing. In Apache Tika, the reuse of SAXParsers and the call to reset after each parse removes the user-specified SecurityManager for Xerces2...