Known vulnerabilities in Apache Tika

Vendor: Apache Foundation
Software: Apache Tika
Software CPE: cpe:2.3:a:apache_foundation:tika:*:*:*:*:*:*:*:*
Website: https://www.apache.org
Total vulnerabilities: 20
Public exploits: 3
Known exploited (KEV): 2
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Apache Tika Apache Tika is affected by 20 known vulnerabilities: 1 critical, 2 high, 15 medium, 2 low Critical High Medium Low

Vulnerabilities (20)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU144803 - Improper Link Resolution Before File Access ('Link Following')
CVE-2026-66756		 CWE-59 Medium
No
No
 4.0.0 beta-1 24.08.2026 SB20260824141
#VU144802 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-66755		 CWE-22 Medium
No
No
 3.3.2, 4.0.0 beta-1 24.08.2026 SB20260824141
SB2026090359
#VU114385 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2025-54988		 CWE-611 Medium
Available
Exploited
 3.2.2 22.08.2025 SB2025082219
SB2025083007
SB2025083008
and 32 more
#VU64724 - Incorrect Regular Expression
CVE-2022-33879		 CWE-185 Medium
No
No
 1.28.4, 2.4.1 28.06.2022 SB2022062801
SB2022072805
SB2022092035
and 18 more
#VU63904 - Improper input validation
CVE-2022-30973		 CWE-20 Medium
No
No
 1.28.3, 2.4.0 01.06.2022 SB2022060114
SB2022072805
SB2022092035
and 6 more
#VU63405 - Resource exhaustion
CVE-2022-25169		 CWE-400 Medium
No
No
 1.28.2, 2.4.0 18.05.2022 SB2022051837
SB2022062703
SB2022062804
and 4 more
#VU63404 - Incorrect Regular Expression
CVE-2022-30126		 CWE-185 Medium
No
No
 1.28.2, 2.4.0 18.05.2022 SB2022051837
SB2022062703
SB2022062804
and 11 more
#VU58816 - Improper Control of Generation of Code ('Code Injection')
CVE-2021-44228		 CWE-94 Critical
Available
Exploited
 1.28, 2.2.1 10.12.2021 SB2021121003
SB2021121101
SB2021121201
and 338 more
#VU51796 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVE-2021-28657		 CWE-835 Medium
No
No
 1.26 30.03.2021 SB2021033021
SB2022042284
SB2021062232
and 4 more
#VU34420 - Missing release of memory after effective lifetime
CVE-2020-9489		 CWE-401 Medium
No
No
 - 27.04.2020 SB2020042727
SB2020102706
SB2020102845
and 2 more
#VU26470 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVE-2020-1951		 CWE-835 Medium
No
No
 1.24 31.03.2020 SB2020033108
SB2020071605
SB2020102927
and 3 more
#VU26469 - Resource exhaustion
CVE-2020-1950		 CWE-400 Medium
No
No
 1.24 31.03.2020 SB2020033108
SB2020100523
SB2025052944
#VU21948 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2018-1335		 CWE-78 High
Available
No
 1.18 20.10.2019 SB2018042526
#VU16676 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVE-2018-17197		 CWE-835 Low
No
No
 1.20 22.12.2018 SB2018122407
SB2020042337
SB2019071640
and 2 more
#VU15310 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2018-11796		 CWE-611 Low
No
No
 1.19.1 10.10.2018 SB2018101101
SB2019112016
#VU14914 - Improper input validation
CVE-2018-8017		 CWE-20 Medium
No
No
 1.19 27.09.2018 SB2018092702
#VU37154 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVE-2018-1338		 CWE-835 Medium
No
No
 1.18 25.04.2018 SB2018042529
SB2018091126
#VU37155 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVE-2018-1339		 CWE-835 Medium
No
No
 1.18 25.04.2018 SB2018042529
SB2018091126
#VU38176 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2016-4434		 CWE-611 High
No
No
 - 30.09.2017 SB2017093007
#VU39973 - Exposure of sensitive information to an unauthorized actor
CVE-2015-3271		 CWE-200 Medium
No
No
 - 16.12.2016 SB2016121610