GitHub Advisoryadvisory · Maven

GHSA-mm7m-xg4h-6m52 Allocation of Resources Without Limits or Throttling in Apache Tika

HIGH Published 2019-08-06 Modified 2021-05-05 Official page ↗
Aliases
CVE-2019-10094
Ecosystem
Maven
Packages
org.apache.tika:tika-core
Severity
High
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-770
Reviewed
2019-08-06

Affected packages

• Maven org.apache.tika:tika-core: >= 1.7, < 1.22 → fixed in 1.22

Description

A carefully crafted package/compressed file that, when unzipped/uncompressed yields the same file (a quine), causes a StackOverflowError in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Apache Tika users should upgrade to 1.22 or later.

Related

Alias · CVE (1)

  • CVE-2019-10094 A carefully crafted package/compressed file that, when unzipped/uncompressed yields the same file (a quine), causes a StackOverflowError in… vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References