Read the docs
TI-2022-12399 Aliases CVE-2022-30126GHSA-rpjm-422r-95mh

Apache Tika Regular Expression Denial of Service in Standards Extractor

Priority LOW 30CWE-1333Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 fixed, 9 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.

Summary

In Apache Tika, a regular expression in our StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler. This is fixed in 1.28.2 and 2.4.0

Why it matters now

EPSS 0.02598 85th percentileScored 2026-11-07
Fix Partial org.apache.tika:tika-core (Maven): 1.28.2, 2.4.0Red Hat: 1 advisoryRed Hat: 1 fixed, 9 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache TikaApache Tika – 1.28.1—No fix listedCNA
—org.apache.tika:tika-core (Maven)1.17 to before 1.28.21.28.2Patch availableGHSA-rpjm-422r-95mh
—org.apache.tika:tika-core (Maven)2.0.0 to before 2.4.02.4.0Patch availableGHSA-rpjm-422r-95mh
  • Apache Tika VendorApache Affected Apache Tika – 1.28.1 Fixed in — No fix listed CNA
  • org.apache.tika:tika-core (Maven) Vendor— Affected 1.17 to before 1.28.2 Fixed in 1.28.2 Patch available GHSA-rpjm-422r-95mh
  • org.apache.tika:tika-core (Maven) Vendor— Affected 2.0.0 to before 2.4.0 Fixed in 2.4.0 Patch available GHSA-rpjm-422r-95mh

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:apache:tika:*:*:*:*:*:*:*:*before 1.28.3; 2.0.0 to before 2.4.0VulnerableApache
cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*17.7 – 17.12VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*18.8VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*19.12VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:*20.12VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:21.12:*:*:*:*:*:*:*21.12VulnerableOracle
  • cpe:2.3:a:apache:tika:*:*:*:*:*:*:*:* Versions before 1.28.3; 2.0.0 to before 2.4.0 Vulnerable ·Apache
  • cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* Versions 17.7 – 17.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* Versions 18.8 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:* Versions 19.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:* Versions 20.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:21.12:*:*:*:*:*:*:* Versions 21.12 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-rpjm-422r-95mh org.apache.tika:tika-core (Maven) Fixed in 1.28.2 Advisory →
  • Fix · GHSA-rpjm-422r-95mh org.apache.tika:tika-core (Maven) Fixed in 2.4.0 Advisory →

Red Hat 1 advisory

  • RHSA-2022:5532 Released 2022-07-07 · Red Hat rating Important
    Red Hat Fuse 7.11.0 release and security update
    • Red Hat Fuse 7.11

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat BPM Suite 6AffectedNo fix planned: Out of support scope
Red Hat Integration Camel K 1AffectedNo fix yet: Fix deferred
Red Hat Integration Camel Quarkus 1AffectedNo fix yet: Fix deferred
Red Hat JBoss BRMS 5AffectedNo fix planned: Out of support scope
Red Hat JBoss BRMS 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat build of QuarkusAffectedNo fix yet: Fix deferred
Red Hat Fuse 7.11Fixed RHSA-2022:5532

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-30126
  2. 2026-10-03 Alias added: GHSA-rpjm-422r-95mh

References

Advisory 8

Other 5

  • TI-2025-40938 XML external entity injection in Apache Tika core CVSS 3.1CRITICAL 9.8
  • TI-2018-01236 From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to… CVSS 3.0HIGH 8.1
  • TI-2025-34694 Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFA CVSS 3.1CRITICAL 9.8
  • TI-2016-05850 Apache Tika before 1.14 allows Java code execution for serialized objects embedded in… CVSS 3.1CRITICAL 9.8
  • TI-2021-13169 An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of… CVSS 3.1HIGH 7.5
  • TI-2019-07413 Resource allocation without limits in Apache Tika CVSS 3.0HIGH 8.8
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences