Read the docs
TI-2018-01239 Aliases CVE-2018-1338GHSA-5mf7-26mw-3rqr

Infinite loop in Apache Tika

Priority LOW 29CWE-835Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 fixed, 2 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-835.

Summary

A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's BPGParser in versions of Apache Tika before 1.18.

Why it matters now

EPSS 0.01916 79th percentileScored 2026-11-07
Fix Partial Apache Tika (Apache Software Foundation): 1.18org.apache.tika:tika-core (Maven): 1.18Red Hat: 1 advisoryRed Hat: 1 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Tikabefore 1.181.18Patch availableCNA
—org.apache.tika:tika-core (Maven)before 1.181.18Patch availableGHSA-5mf7-26mw-3rqr
  • Apache Tika VendorApache Affected before 1.18 Fixed in 1.18 Patch available CNA
  • org.apache.tika:tika-core (Maven) Vendor— Affected before 1.18 Fixed in 1.18 Patch available GHSA-5mf7-26mw-3rqr

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:tika:*:*:*:*:*:*:*:*before 1.18VulnerableApache
  • cpe:2.3:a:apache:tika:*:*:*:*:*:*:*:* Versions before 1.18 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Tika (Apache Software Foundation) Fixed in 1.18
  • Fix · GHSA-5mf7-26mw-3rqr org.apache.tika:tika-core (Maven) Fixed in 1.18 Advisory →

Red Hat 1 advisory

  • RHSA-2018:2669 Released 2018-09-11 · Red Hat rating Important
    Fuse 7.1 security update
    • Red Hat Fuse 7

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Will not fix
Red Hat Satellite 5AffectedNo fix planned: Will not fix
Red Hat Fuse 7Fixed RHSA-2018:2669
Not affected: 6 products
  • Red Hat BPM Suite 6
  • Red Hat JBoss BRMS 5
  • Red Hat JBoss BRMS 6
  • Red Hat JBoss Fuse Integration Service 2
  • Red Hat JBoss Fuse Service Works 6
  • Red Hat Software Collections

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-1338
  2. 2026-10-03 Alias added: GHSA-5mf7-26mw-3rqr
  3. 2026-11-03 Fix available: Red Hat Fuse 7 · Red Hat

References

Advisory 3

Other 2

  • TI-2025-40938 XML external entity injection in Apache Tika core CVSS 3.1CRITICAL 9.8
  • TI-2018-01236 From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to… CVSS 3.0HIGH 8.1
  • TI-2025-34694 Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFA CVSS 3.1CRITICAL 9.8
  • TI-2016-05850 Apache Tika before 1.14 allows Java code execution for serialized objects embedded in… CVSS 3.1CRITICAL 9.8
  • TI-2021-13169 An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of… CVSS 3.1HIGH 7.5
  • TI-2019-07413 Resource allocation without limits in Apache Tika CVSS 3.0HIGH 8.8
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences