Resource allocation without limits in Apache Tika
Priority LOW 35CWE-770Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-770.
Summary
In Apache Tika 1.19 to 1.21, a carefully crafted 2003ml or 2006ml file could consume all available SAXParsers in the pool and lead to very long hangs. Apache Tika users should upgrade to 1.22 or later.
Why it matters now
EPSS 0.03699 89th percentileScored 2026-11-07
Fix Fixed org.apache.tika:tika-parsers (Maven): 1.22
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Tika | 1.19 to 1.21 | — | No fix listed | CNA |
| — | org.apache.tika:tika-parsers (Maven) | 1.19 to before 1.22 | 1.22 | Patch available | GHSA-4mq5-mj59-qq9c |
- Apache Tika VendorApache Affected 1.19 to 1.21 Fixed in — No fix listed CNA
- org.apache.tika:tika-parsers (Maven) Vendor— Affected 1.19 to before 1.22 Fixed in 1.22 Patch available GHSA-4mq5-mj59-qq9c
Remediation
- Fix · GHSA-4mq5-mj59-qq9c org.apache.tika:tika-parsers (Maven) Fixed in 1.22 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2019-10093
- 2026-10-03 Alias added: GHSA-4mq5-mj59-qq9c
References
Other 14
- https://lists.apache.org/thread.html/a5a44eff1b9eda3bc69d22943a1030c43d376380c75d3ab04d0c1a21%40%3Cdev.tika.apache.org%3E
- [tika-dev] 20190809 security fixes for CVE-2019-10088 and CVE-2019-1009{3,4}
- [tika-dev] 20190812 Re: security fixes for CVE-2019-10088 and CVE-2019-1009{3,4}
- [tika-dev] 20190813 Re: security fixes for CVE-2019-10088 and CVE-2019-1009{3,4}
- https://security.netapp.com/advisory/ntap-20190828-0004/
- https://www.oracle.com/security-alerts/cpujan2020.html
- [lucene-solr-user] 20200320 CVEs (vulnerabilities) that apply to Solr 8.4.1
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://lists.apache.org/thread.html/39723d8227b248781898c200aa24b154683673287b150a204b83787d@%3Cdev.tika.apache.org%3E
- https://lists.apache.org/thread.html/a5a44eff1b9eda3bc69d22943a1030c43d376380c75d3ab04d0c1a21@%3Cdev.tika.apache.org%3E
- https://lists.apache.org/thread.html/da9ee189d1756f8508d0f2386d8e25aca5a6df541739829232be8a94@%3Cdev.tika.apache.org%3E
- https://lists.apache.org/thread.html/fb6c84fd387de997e5e366d50b0ca331a328c466432c80f8c5eed33d@%3Cdev.tika.apache.org%3E
- https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5@%3Csolr-user.lucene.apache.org%3E
- https://security.netapp.com/advisory/ntap-20190828-0004
More Apache Tika vulnerabilities
- TI-2025-40938 XML external entity injection in Apache Tika core CVSS 3.1CRITICAL 9.8
- TI-2018-01236 From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to… CVSS 3.0HIGH 8.1
- TI-2025-34694 Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFA CVSS 3.1CRITICAL 9.8
- TI-2016-05850 Apache Tika before 1.14 allows Java code execution for serialized objects embedded in… CVSS 3.1CRITICAL 9.8
- TI-2021-13169 An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of… CVSS 3.1HIGH 7.5
- TI-2019-07413 Resource allocation without limits in Apache Tika CVSS 3.0HIGH 8.8
Sources
- CVE-2019-10093 · CVE Program
- CVE-2019-10093 · NVD
- FIRST EPSS
- GHSA-4mq5-mj59-qq9c · GitHub Advisory Database · CC BY 4.0
- CVE-2019-10093 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences