Read the docs
TI-2022-13029 Aliases CVE-2022-30973GHSA-qw3f-w4pf-jh5f

Missing fix for CVE-2022-30126 in 1.28.2

Priority LOW 29CWE-1333Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 fixed, 8 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.

Summary

We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the 1.28.2 release. In Apache Tika, a regular expression in the StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler. This is fixed in 1.28.3.

Why it matters now

EPSS 0.01982 80th percentileScored 2026-11-07
Fix Partial org.apache.tika:tika-core (Maven): 1.28.3Red Hat: 1 advisoryRed Hat: 1 fixed, 8 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache TikaApache Tika – 1.28.2—No fix listedCNA
—org.apache.tika:tika-core (Maven)1.17 to before 1.28.31.28.3Patch availableGHSA-qw3f-w4pf-jh5f
  • Apache Tika VendorApache Affected Apache Tika – 1.28.2 Fixed in — No fix listed CNA
  • org.apache.tika:tika-core (Maven) Vendor— Affected 1.17 to before 1.28.3 Fixed in 1.28.3 Patch available GHSA-qw3f-w4pf-jh5f

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:tika:*:*:*:*:*:*:*:*before 1.28.3VulnerableApache
  • cpe:2.3:a:apache:tika:*:*:*:*:*:*:*:* Versions before 1.28.3 Vulnerable ·Apache

Remediation

  • Fix · GHSA-qw3f-w4pf-jh5f org.apache.tika:tika-core (Maven) Fixed in 1.28.3 Advisory →

Red Hat 1 advisory

  • RHSA-2022:7257 Released 2022-10-27 · Red Hat rating Low
    Red Hat Integration Camel-K 1.8.1 security update
    • RHINT Camel-K 1.8.1

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat BPM Suite 6AffectedNo fix planned: Out of support scope
Red Hat Fuse 7AffectedNo fix yet: Fix deferred
Red Hat Integration Camel Quarkus 1AffectedNo fix yet: Fix deferred
Red Hat JBoss BRMS 5AffectedNo fix planned: Out of support scope
Red Hat JBoss BRMS 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
RHINT Camel-K 1.8.1Fixed RHSA-2022:7257
Not affected: 1 product
  • Red Hat build of Quarkus

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-30973
  2. 2026-10-03 Alias added: GHSA-qw3f-w4pf-jh5f

References

Advisory 6

Other 4

  • TI-2025-40938 XML external entity injection in Apache Tika core CVSS 3.1CRITICAL 9.8
  • TI-2018-01236 From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to… CVSS 3.0HIGH 8.1
  • TI-2025-34694 Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFA CVSS 3.1CRITICAL 9.8
  • TI-2016-05850 Apache Tika before 1.14 allows Java code execution for serialized objects embedded in… CVSS 3.1CRITICAL 9.8
  • TI-2021-13169 An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of… CVSS 3.1HIGH 7.5
  • TI-2019-07413 Resource allocation without limits in Apache Tika CVSS 3.0HIGH 8.8
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences