GHSA-H8Q5-G2CJ-QR5H Apache Tika is vulnerable to entity expansions which can lead to a denial of service attack

In Apache Tika 1.19 CVE-2018-11761, we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and thus removes entity expansion limits after...