Read the docs
TI-2020-01874 Aliases CVE-2020-1950GHSA-3h29-52vh-pqgr

Uncontrolled resource consumption in Apache Tika

Priority LOW 30CWE-400Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 fixed, 6 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

A carefully crafted or corrupt PSD file can cause excessive memory usage in Apache Tika's PSDParser in versions 1.0-1.23.

Why it matters now

EPSS 0.02986 87th percentileScored 2026-11-07
Fix Partial org.apache.tika:tika (Maven): 1.24Red Hat: 1 advisoryRed Hat: 1 fixed, 6 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache TikaApache Tika 1.0-1.23—No fix listedCNA
—org.apache.tika:tika (Maven)1.0 to before 1.241.24Patch availableGHSA-3h29-52vh-pqgr
  • Apache Tika VendorApache Affected Apache Tika 1.0-1.23 Fixed in — No fix listed CNA
  • org.apache.tika:tika (Maven) Vendor— Affected 1.0 to before 1.24 Fixed in 1.24 Patch available GHSA-3h29-52vh-pqgr

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:a:apache:tika:*:*:*:*:*:*:*:*1.0 – 1.23VulnerableApache
cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:communications_messaging_server:8.0.2:*:*:*:*:*:*:*8.0.2VulnerableOracle
cpe:2.3:a:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:*8.1VulnerableOracle
cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:*12.0.0VulnerableOracle
cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:*12.1.0VulnerableOracle
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*16.04VulnerableCanonical
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
  • cpe:2.3:a:apache:tika:*:*:*:*:*:*:*:* Versions 1.0 – 1.23 Vulnerable ·Apache
  • cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_messaging_server:8.0.2:*:*:*:*:*:*:* Versions 8.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:* Versions 12.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:* Versions 12.1.0 Vulnerable ·Oracle
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* Versions 16.04 Vulnerable ·Canonical
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian

Remediation

  • Fix · GHSA-3h29-52vh-pqgr org.apache.tika:tika (Maven) Fixed in 1.24 Advisory →

Red Hat 1 advisory

  • RHSA-2020:5568 Released 2020-12-16 · Red Hat rating Important
    Red Hat Fuse 7.8.0 release and security update
    • Red Hat Fuse 7.8.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Apache Tika — USN-4564-1

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2020-01875 A carefully crafted or corrupt PSD file can cause an infinite loop in Apache Tika's PSDParser in versions 1.0-1.23.Priority LOW 30
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat BPM Suite 6AffectedNo fix planned: Out of support scope
Red Hat JBoss BRMS 5AffectedNo fix planned: Out of support scope
Red Hat JBoss BRMS 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat Satellite 5AffectedNo fix planned: Out of support scope
Red Hat Fuse 7.8.0Fixed RHSA-2020:5568

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-1950
  2. 2026-10-03 Alias added: GHSA-3h29-52vh-pqgr

References

Patch 2

Advisory 4

Other 2

  • TI-2025-40938 XML external entity injection in Apache Tika core CVSS 3.1CRITICAL 9.8
  • TI-2018-01236 From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to… CVSS 3.0HIGH 8.1
  • TI-2025-34694 Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFA CVSS 3.1CRITICAL 9.8
  • TI-2016-05850 Apache Tika before 1.14 allows Java code execution for serialized objects embedded in… CVSS 3.1CRITICAL 9.8
  • TI-2021-13169 An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of… CVSS 3.1HIGH 7.5
  • TI-2019-07413 Resource allocation without limits in Apache Tika CVSS 3.0HIGH 8.8
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences