Read the docs
TI-2020-01875 Aliases CVE-2020-1951GHSA-3264-3fm9-fg44

A carefully crafted or corrupt PSD file can cause an infinite loop in Apache Tika's PSDParser in versions 1.0-1.23.

Priority LOW 30CWE-835Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-835.

Summary

A carefully crafted or corrupt PSD file can cause an infinite loop in Apache Tika's PSDParser in versions 1.0-1.23.

Why it matters now

EPSS 0.02892 86th percentileScored 2026-11-07
Fix Fixed org.apache.tika:tika (Maven): 1.24

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Apache TikaApache Tika 1.0-1.23—No fix listedCNA
—org.apache.tika:tika (Maven)1.0 to before 1.241.24Patch availableGHSA-3264-3fm9-fg44
  • Apache Tika Vendor— Affected Apache Tika 1.0-1.23 Fixed in — No fix listed CNA
  • org.apache.tika:tika (Maven) Vendor— Affected 1.0 to before 1.24 Fixed in 1.24 Patch available GHSA-3264-3fm9-fg44

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:a:apache:tika:*:*:*:*:*:*:*:*1.0 – 1.23VulnerableApache
cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:communications_messaging_server:8.0.2:*:*:*:*:*:*:*8.0.2VulnerableOracle
cpe:2.3:a:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:*8.1VulnerableOracle
cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:*12.0.0VulnerableOracle
cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:*12.1.0VulnerableOracle
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*16.04VulnerableCanonical
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
  • cpe:2.3:a:apache:tika:*:*:*:*:*:*:*:* Versions 1.0 – 1.23 Vulnerable ·Apache
  • cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_messaging_server:8.0.2:*:*:*:*:*:*:* Versions 8.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:* Versions 12.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:* Versions 12.1.0 Vulnerable ·Oracle
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* Versions 16.04 Vulnerable ·Canonical
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian

Remediation

  • Fix · GHSA-3264-3fm9-fg44 org.apache.tika:tika (Maven) Fixed in 1.24 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Apache Tika — USN-4564-1

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2020-01874 Uncontrolled resource consumption in Apache TikaPriority LOW 30
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-1951
  2. 2026-10-03 Alias added: GHSA-3264-3fm9-fg44

References

Patch 2

Advisory 4

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences