Read the docs
TI-2022-14889 Aliases CVE-2022-33879GHSA-6q8v-2hvm-fx37

Incomplete fix and new regex DoS in StandardsExtractingContentHandler

Priority LOW 20Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate, new regex DoS in a different regex in the StandardsExtractingContentHandler. These are now fixed in 1.28.4 and 2.4.1.

Why it matters now

EPSS 0.02032 81st percentileScored 2026-11-07
Fix Fixed Apache Tika (Apache Software Foundation): 2.4.1org.apache.tika:tika (Maven): 1.28.4, 2.4.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache TikaApache Tika to before 2.4.12.4.1Patch availableCNA
—org.apache.tika:tika (Maven)before 1.28.41.28.4Patch availableGHSA-6q8v-2hvm-fx37
—org.apache.tika:tika (Maven)2.0.0 to before 2.4.12.4.1Patch availableGHSA-6q8v-2hvm-fx37
  • Apache Tika VendorApache Affected Apache Tika to before 2.4.1 Fixed in 2.4.1 Patch available CNA
  • org.apache.tika:tika (Maven) Vendor— Affected before 1.28.4 Fixed in 1.28.4 Patch available GHSA-6q8v-2hvm-fx37
  • org.apache.tika:tika (Maven) Vendor— Affected 2.0.0 to before 2.4.1 Fixed in 2.4.1 Patch available GHSA-6q8v-2hvm-fx37

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:tika:*:*:*:*:*:*:*:*before 1.28.4; 2.0.0 to before 2.4.1VulnerableApache
  • cpe:2.3:a:apache:tika:*:*:*:*:*:*:*:* Versions before 1.28.4; 2.0.0 to before 2.4.1 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Tika (Apache Software Foundation) Fixed in 2.4.1
  • Fix · GHSA-6q8v-2hvm-fx37 org.apache.tika:tika (Maven) Fixed in 1.28.4 Advisory →
  • Fix · GHSA-6q8v-2hvm-fx37 org.apache.tika:tika (Maven) Fixed in 2.4.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-33879
  2. 2026-10-03 Alias added: GHSA-6q8v-2hvm-fx37

References

Advisory 4

Other 1

  • TI-2025-40938 XML external entity injection in Apache Tika core CVSS 3.1CRITICAL 9.8
  • TI-2018-01236 From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to… CVSS 3.0HIGH 8.1
  • TI-2025-34694 Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFA CVSS 3.1CRITICAL 9.8
  • TI-2016-05850 Apache Tika before 1.14 allows Java code execution for serialized objects embedded in… CVSS 3.1CRITICAL 9.8
  • TI-2021-13169 An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of… CVSS 3.1HIGH 7.5
  • TI-2019-07413 Resource allocation without limits in Apache Tika CVSS 3.0HIGH 8.8
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences