CVE-2022-30126
published 2022-05-31CVE-2022-30126: We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the 1.28.2 release. In Apache Tika, a regular expression in the StandardsText class, used by…
PriorityP422medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
2.52%
83.1th percentile
We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the 1.28.2 release. In Apache Tika, a regular expression in the StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler. This is fixed in 1.28.3.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tika | < 1.28.3 | 1.28.3 |
| apache | tika | < 1.28.4 | 1.28.4 |
| apache | tika | >= 0 < 1.22-1ubuntu0.1~esm1 | 1.22-1ubuntu0.1~esm1 |
| apache | tika | >= 0 < 1.22-2ubuntu0.22.04.1~esm1 | 1.22-2ubuntu0.22.04.1~esm1 |
| apache | tika | >= 2.0.0 < 2.4.1 | 2.4.1 |
| apache | tika | >= 2.0.0 < 2.4.0 | 2.4.0 |
| apache_software_foundation | apache_tika | >= Apache Tika < 2.4.1 | 2.4.1 |
| debian | tika | — | — |
| oracle | primavera_unifier | — | — |
| oracle | primavera_unifier | — | — |
| oracle | primavera_unifier | — | — |
| oracle | primavera_unifier | — | — |
| oracle | primavera_unifier | 17.7 – 17.12 | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
ghsa5.5MEDIUM
osv5.5MEDIUM
vendor_debian5.5LOW
vendor_oracle5.5MEDIUM
vendor_redhat5.5MEDIUM
vendor_ubuntu5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
tika vulnerabilities
osv·2025-05-23·CVSS 5.5
CVE-2020-1950 [MEDIUM] tika vulnerabilities
tika vulnerabilities
It was discovered that Apache Tika can have an excessive memory usage by
using a crafted or corrupt PSD file. An attacker could possibly use this
issue to cause a denial of service. This issue only affected Ubuntu
20.04 LTS. (CVE-2020-1950, CVE-2020-1951)
It was discovered that Apache Tika incorrectly handled certain regular
expressions. An attacker could possibly use this issue to cause a denial
of service. (CVE-2022-30126, CVE-2022-30973, CVE-2022-33879)
OSV
Apache Tika contains incomplete fix for regex DoS
osv·2022-06-28·CVSS 5.5
CVE-2022-33879 [MEDIUM] Apache Tika contains incomplete fix for regex DoS
Apache Tika contains incomplete fix for regex DoS
The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate, new regex DoS in a different regex in the StandardsExtractingContentHandler. These are now fixed in 1.28.4 and 2.4.1.
GHSA
Apache Tika contains incomplete fix for regex DoS
ghsa·2022-06-28·CVSS 5.5
CVE-2022-33879 [MEDIUM] Apache Tika contains incomplete fix for regex DoS
Apache Tika contains incomplete fix for regex DoS
The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate, new regex DoS in a different regex in the StandardsExtractingContentHandler. These are now fixed in 1.28.4 and 2.4.1.
OSV
CVE-2022-33879: The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate
osv·2022-06-27·CVSS 5.5
CVE-2022-33879 [MEDIUM] CVE-2022-33879: The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate
The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate, new regex DoS in a different regex in the StandardsExtractingContentHandler. These are now fixed in 1.28.4 and 2.4.1.
OSV
Regular expression denial of service in apache tika
osv·2022-06-01·CVSS 5.5
CVE-2022-30973 [MEDIUM] Regular expression denial of service in apache tika
Regular expression denial of service in apache tika
We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the 1.28.2 release. In Apache Tika, a regular expression in the StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler. This is fixed in 1.28.3.
GHSA
Regular expression denial of service in apache tika
ghsa·2022-06-01·CVSS 5.5
CVE-2022-30973 [MEDIUM] CWE-1333 Regular expression denial of service in apache tika
Regular expression denial of service in apache tika
We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the 1.28.2 release. In Apache Tika, a regular expression in the StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler. This is fixed in 1.28.3.
OSV
CVE-2022-30973: We failed to apply the fix for CVE-2022-30126 to the 1
osv·2022-05-31·CVSS 5.5
CVE-2022-30973 [MEDIUM] CVE-2022-30973: We failed to apply the fix for CVE-2022-30126 to the 1
We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the 1.28.2 release. In Apache Tika, a regular expression in the StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler. This is fixed in 1.28.3.
OSV
Regular expression denial of service in apache tika
osv·2022-05-17
CVE-2022-30126 [MEDIUM] Regular expression denial of service in apache tika
Regular expression denial of service in apache tika
In Apache Tika, a regular expression in our StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler.
This was originally fixed in 1.28.2 and 2.4.0. While the fix in version 2.4.0 was complete, the fix for the 1.x branch wasn't incorporated until version 1.28.3. Please see GHSA-qw3f-w4pf-jh5f for more information.
GHSA
Regular expression denial of service in apache tika
ghsa·2022-05-17
CVE-2022-30126 [MEDIUM] CWE-1333 Regular expression denial of service in apache tika
Regular expression denial of service in apache tika
In Apache Tika, a regular expression in our StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler.
This was originally fixed in 1.28.2 and 2.4.0. While the fix in version 2.4.0 was complete, the fix for the 1.x branch wasn't incorporated until version 1.28.3. Please see GHSA-qw3f-w4pf-jh5f for more information.
OSV
CVE-2022-30126: In Apache Tika, a regular expression in our StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service cause
osv·2022-05-16·CVSS 5.5
CVE-2022-30126 [MEDIUM] CVE-2022-30126: In Apache Tika, a regular expression in our StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service cause
In Apache Tika, a regular expression in our StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler. This is fixed in 1.28.2 and 2.4.0
Ubuntu
Apache Tika vulnerabilities
vendor_ubuntu·2025-05-23·CVSS 5.5
CVE-2022-30126 [MEDIUM] Apache Tika vulnerabilities
Title: Apache Tika vulnerabilities
Summary: Several security issues were fixed in Apache Tika.
It was discovered that Apache Tika can have an excessive memory usage by
using a crafted or corrupt PSD file. An attacker could possibly use this
issue to cause a denial of service. This issue only affected Ubuntu
20.04 LTS. (CVE-2020-1950, CVE-2020-1951)
It was discovered that Apache Tika incorrectly handled certain regular
expressions. An attacker could possibly use this issue to cause a denial
of service. (CVE-2022-30126, CVE-2022-30973, CVE-2022-33879)
Instructions: In general, a standard system update will make all the necessary changes.
Oracle
Oracle Oracle Communications Applications Risk Matrix: ISC (Apache Tika) — CVE-2022-30126
vendor_oracle·2023-01-15·CVSS 5.5
CVE-2022-30126 [MEDIUM] Oracle Oracle Communications Applications Risk Matrix: ISC (Apache Tika) — CVE-2022-30126
Oracle Oracle Communications Applications Risk Matrix: ISC (Apache Tika) vulnerability
CVE: CVE-2022-30126
CVSS: 5.5
Protocol: None
Remote exploit: No
Affected versions: Local
Advisory: cpujan2023 (JAN 2023)
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Security Framework (Apache Tika) — CVE-2022-30126
vendor_oracle·2022-10-15·CVSS 5.5
CVE-2022-30126 [MEDIUM] Oracle Oracle Fusion Middleware Risk Matrix: Security Framework (Apache Tika) — CVE-2022-30126
Oracle Oracle Fusion Middleware Risk Matrix: Security Framework (Apache Tika) vulnerability
CVE: CVE-2022-30126
CVSS: 5.5
Protocol: None
Remote exploit: No
Affected versions: Local
Advisory: cpuoct2022 (OCT 2022)
Oracle
Oracle Oracle Construction and Engineering Risk Matrix: Document Management (Apache Tika) — CVE-2022-30126
vendor_oracle·2022-07-15·CVSS 5.5
CVE-2022-30126 [MEDIUM] Oracle Oracle Construction and Engineering Risk Matrix: Document Management (Apache Tika) — CVE-2022-30126
Oracle Oracle Construction and Engineering Risk Matrix: Document Management (Apache Tika) vulnerability
CVE: CVE-2022-30126
CVSS: 5.5
Protocol: None
Remote exploit: No
Affected versions: Local
Advisory: cpujul2022 (JUL 2022)
Red Hat
tika-core: incomplete fix for CVE-2022-30126
vendor_redhat·2022-05-31·CVSS 5.5
CVE-2022-30973 [MEDIUM] CWE-1333 tika-core: incomplete fix for CVE-2022-30126
tika-core: incomplete fix for CVE-2022-30126
We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the 1.28.2 release. In Apache Tika, a regular expression in the StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler. This is fixed in 1.28.3.
Package: tika-core (Red Hat BPM Suite 6) - Out of support scope
Package: tika-core (Red Hat build of Quarkus) - Not affected
Package: tika-core (Red Hat Fuse 7) - Fix deferred
Package: tika-core (Red Hat Integration Camel Quarkus 1) - Fix deferred
Package: tika-core (Red Hat JBoss BRMS 5) - Out of support scope
Package: tika-
Red Hat
tika-core: Regular Expression Denial of Service in standards extractor
vendor_redhat·2022-05-16·CVSS 5.5
CVE-2022-30126 [MEDIUM] CWE-1333 tika-core: Regular Expression Denial of Service in standards extractor
tika-core: Regular Expression Denial of Service in standards extractor
In Apache Tika, a regular expression in our StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler. This is fixed in 1.28.2 and 2.4.0
Package: tika-core (Red Hat BPM Suite 6) - Out of support scope
Package: tika-core (Red Hat build of Quarkus) - Fix deferred
Package: tika-core (Red Hat Integration Camel K 1) - Fix deferred
Package: tika-core (Red Hat Integration Camel Quarkus 1) - Fix deferred
Package: tika-core (Red Hat JBoss BRMS 5) - Out of support scope
Package: tika-core (Red Hat JBoss BRMS 6) - Out of
Debian
CVE-2022-30126: tika - In Apache Tika, a regular expression in our StandardsText class, used by the Sta...
vendor_debian·2022·CVSS 5.5
CVE-2022-30126 [MEDIUM] CVE-2022-30126: tika - In Apache Tika, a regular expression in our StandardsText class, used by the Sta...
In Apache Tika, a regular expression in our StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler. This is fixed in 1.28.2 and 2.4.0
Scope: local
bullseye: open
sid: open
Debian
CVE-2022-33879: tika - The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the Standa...
vendor_debian·2022·CVSS 5.5
CVE-2022-33879 [MEDIUM] CVE-2022-33879: tika - The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the Standa...
The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate, new regex DoS in a different regex in the StandardsExtractingContentHandler. These are now fixed in 1.28.4 and 2.4.1.
Scope: local
bullseye: open
sid: open
Debian
CVE-2022-30973: tika - We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the 1.28.2 re...
vendor_debian·2022·CVSS 5.5
CVE-2022-30973 [MEDIUM] CVE-2022-30973: tika - We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the 1.28.2 re...
We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the 1.28.2 release. In Apache Tika, a regular expression in the StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler. This is fixed in 1.28.3.
Scope: local
bullseye: resolved
sid: resolved
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.openwall.com/lists/oss-security/2022/05/31/2http://www.openwall.com/lists/oss-security/2022/06/27/5https://lists.apache.org/thread/gqvb5t4p7tmdpl0y5bdbf72pgxj04h7phttps://security.netapp.com/advisory/ntap-20220722-0004/http://www.openwall.com/lists/oss-security/2022/05/31/2http://www.openwall.com/lists/oss-security/2022/06/27/5https://lists.apache.org/thread/gqvb5t4p7tmdpl0y5bdbf72pgxj04h7phttps://security.netapp.com/advisory/ntap-20220722-0004/
2022-05-31
Published