Apache Tika BPGParser Memory Usage DoS
Priority LOW 29CWE-770Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-770.
Summary
The BPG parser in versions of Apache Tika before 1.28.2 and 2.4.0 may allocate an unreasonable amount of memory on carefully crafted files.
Why it matters now
EPSS 0.02196 82nd percentileScored 2026-11-07
Fix Fixed org.apache.tika:tika (Maven): 1.28.2, 2.4.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Tika | Apache Tika – 1.28.1 | — | No fix listed | CNA |
| — | org.apache.tika:tika (Maven) | before 1.28.2 | 1.28.2 | Patch available | GHSA-7qcq-xp2f-56f6 |
| — | org.apache.tika:tika (Maven) | 2.0.0 to before 2.4.0 | 2.4.0 | Patch available | GHSA-7qcq-xp2f-56f6 |
- Apache Tika VendorApache Affected Apache Tika – 1.28.1 Fixed in — No fix listed CNA
- org.apache.tika:tika (Maven) Vendor— Affected before 1.28.2 Fixed in 1.28.2 Patch available GHSA-7qcq-xp2f-56f6
- org.apache.tika:tika (Maven) Vendor— Affected 2.0.0 to before 2.4.0 Fixed in 2.4.0 Patch available GHSA-7qcq-xp2f-56f6
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tika:*:*:*:*:*:*:*:* | before 1.28.2; 2.0.0 to before 2.4.0 | Vulnerable | Apache |
| cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* | 17.7 – 17.12 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* | 18.8 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:* | 19.12 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:* | 20.12 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:21.12:*:*:*:*:*:*:* | 21.12 | Vulnerable | Oracle |
- cpe:2.3:a:apache:tika:*:*:*:*:*:*:*:* Versions before 1.28.2; 2.0.0 to before 2.4.0 Vulnerable ·Apache
- cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* Versions 17.7 – 17.12 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* Versions 18.8 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:* Versions 19.12 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:* Versions 20.12 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:21.12:*:*:*:*:*:*:* Versions 21.12 Vulnerable ·Oracle
Remediation
- Fix · GHSA-7qcq-xp2f-56f6 org.apache.tika:tika (Maven) Fixed in 1.28.2 Advisory →
- Fix · GHSA-7qcq-xp2f-56f6 org.apache.tika:tika (Maven) Fixed in 2.4.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-25169
- 2026-10-03 Alias added: GHSA-7qcq-xp2f-56f6
References
Advisory 5
More Apache Tika vulnerabilities
- TI-2025-40938 XML external entity injection in Apache Tika core CVSS 3.1CRITICAL 9.8
- TI-2018-01236 From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to… CVSS 3.0HIGH 8.1
- TI-2025-34694 Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFA CVSS 3.1CRITICAL 9.8
- TI-2016-05850 Apache Tika before 1.14 allows Java code execution for serialized objects embedded in… CVSS 3.1CRITICAL 9.8
- TI-2021-13169 An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of… CVSS 3.1HIGH 7.5
- TI-2019-07413 Resource allocation without limits in Apache Tika CVSS 3.0HIGH 8.8
Sources
- CVE-2022-25169 · CVE Program
- CVE-2022-25169 · NVD
- FIRST EPSS
- GHSA-7qcq-xp2f-56f6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences