GitHub Advisoryadvisory · Maven

GHSA-4mq5-mj59-qq9c Allocation of Resources Without Limits or Throttling in Apache Tika

MEDIUM Published 2019-08-06 Modified 2021-05-05 Official page ↗
Aliases
CVE-2019-10093
Ecosystem
Maven
Packages
org.apache.tika:tika-parsers
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weaknesses
CWE-770
Reviewed
2019-08-06

Affected packages

• Maven org.apache.tika:tika-parsers: >= 1.19, < 1.22 → fixed in 1.22

Description

In Apache Tika 1.19 to 1.21, a carefully crafted 2003ml or 2006ml file could consume all available SAXParsers in the pool and lead to very long hangs. Apache Tika users should upgrade to 1.22 or later.

Related

Alias · CVE (1)

  • CVE-2019-10093 In Apache Tika 1.19 to 1.21, a carefully crafted 2003ml or 2006ml file could consume all available SAXParsers in the pool and lead to very… vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References