CVE-2022-30973
published 2022-05-31CVE-2022-30973: We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the 1.28.2 release. In Apache Tika, a regular expression in the StandardsText class, used by…
PriorityP423medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
1.86%
76.8th percentile
We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the 1.28.2 release. In Apache Tika, a regular expression in the StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler. This is fixed in 1.28.3.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tika | < 1.28.3 | 1.28.3 |
| apache | tika | < 1.28.4 | 1.28.4 |
| apache | tika | >= 0 < 1.22-1ubuntu0.1~esm1 | 1.22-1ubuntu0.1~esm1 |
| apache | tika | >= 0 < 1.22-2ubuntu0.22.04.1~esm1 | 1.22-2ubuntu0.22.04.1~esm1 |
| apache | tika | >= 2.0.0 < 2.4.1 | 2.4.1 |
| debian | tika | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv2.02.6LOWAV:N/AC:H/Au:N/C:N/I:N/A:P
ghsa5.5MEDIUM
osv5.5MEDIUM
vendor_debian5.5LOW
vendor_redhat5.5MEDIUM
vendor_ubuntu5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
tika vulnerabilities
osv·2025-05-23·CVSS 5.5
CVE-2020-1950 [MEDIUM] tika vulnerabilities
tika vulnerabilities
It was discovered that Apache Tika can have an excessive memory usage by
using a crafted or corrupt PSD file. An attacker could possibly use this
issue to cause a denial of service. This issue only affected Ubuntu
20.04 LTS. (CVE-2020-1950, CVE-2020-1951)
It was discovered that Apache Tika incorrectly handled certain regular
expressions. An attacker could possibly use this issue to cause a denial
of service. (CVE-2022-30126, CVE-2022-30973, CVE-2022-33879)
OSV
Apache Tika contains incomplete fix for regex DoS
osv·2022-06-28·CVSS 5.5
CVE-2022-33879 [MEDIUM] Apache Tika contains incomplete fix for regex DoS
Apache Tika contains incomplete fix for regex DoS
The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate, new regex DoS in a different regex in the StandardsExtractingContentHandler. These are now fixed in 1.28.4 and 2.4.1.
GHSA
Apache Tika contains incomplete fix for regex DoS
ghsa·2022-06-28·CVSS 5.5
CVE-2022-33879 [MEDIUM] Apache Tika contains incomplete fix for regex DoS
Apache Tika contains incomplete fix for regex DoS
The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate, new regex DoS in a different regex in the StandardsExtractingContentHandler. These are now fixed in 1.28.4 and 2.4.1.
OSV
CVE-2022-33879: The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate
osv·2022-06-27·CVSS 5.5
CVE-2022-33879 [MEDIUM] CVE-2022-33879: The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate
The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate, new regex DoS in a different regex in the StandardsExtractingContentHandler. These are now fixed in 1.28.4 and 2.4.1.
OSV
Regular expression denial of service in apache tika
osv·2022-06-01·CVSS 5.5
CVE-2022-30973 [MEDIUM] Regular expression denial of service in apache tika
Regular expression denial of service in apache tika
We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the 1.28.2 release. In Apache Tika, a regular expression in the StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler. This is fixed in 1.28.3.
GHSA
Regular expression denial of service in apache tika
ghsa·2022-06-01·CVSS 5.5
CVE-2022-30973 [MEDIUM] CWE-1333 Regular expression denial of service in apache tika
Regular expression denial of service in apache tika
We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the 1.28.2 release. In Apache Tika, a regular expression in the StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler. This is fixed in 1.28.3.
OSV
CVE-2022-30973: We failed to apply the fix for CVE-2022-30126 to the 1
osv·2022-05-31·CVSS 5.5
CVE-2022-30973 [MEDIUM] CVE-2022-30973: We failed to apply the fix for CVE-2022-30126 to the 1
We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the 1.28.2 release. In Apache Tika, a regular expression in the StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler. This is fixed in 1.28.3.
Ubuntu
Apache Tika vulnerabilities
vendor_ubuntu·2025-05-23·CVSS 5.5
CVE-2022-30126 [MEDIUM] Apache Tika vulnerabilities
Title: Apache Tika vulnerabilities
Summary: Several security issues were fixed in Apache Tika.
It was discovered that Apache Tika can have an excessive memory usage by
using a crafted or corrupt PSD file. An attacker could possibly use this
issue to cause a denial of service. This issue only affected Ubuntu
20.04 LTS. (CVE-2020-1950, CVE-2020-1951)
It was discovered that Apache Tika incorrectly handled certain regular
expressions. An attacker could possibly use this issue to cause a denial
of service. (CVE-2022-30126, CVE-2022-30973, CVE-2022-33879)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
tika-core: incomplete fix for CVE-2022-30126
vendor_redhat·2022-05-31·CVSS 5.5
CVE-2022-30973 [MEDIUM] CWE-1333 tika-core: incomplete fix for CVE-2022-30126
tika-core: incomplete fix for CVE-2022-30126
We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the 1.28.2 release. In Apache Tika, a regular expression in the StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler. This is fixed in 1.28.3.
Package: tika-core (Red Hat BPM Suite 6) - Out of support scope
Package: tika-core (Red Hat build of Quarkus) - Not affected
Package: tika-core (Red Hat Fuse 7) - Fix deferred
Package: tika-core (Red Hat Integration Camel Quarkus 1) - Fix deferred
Package: tika-core (Red Hat JBoss BRMS 5) - Out of support scope
Package: tika-
Debian
CVE-2022-33879: tika - The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the Standa...
vendor_debian·2022·CVSS 5.5
CVE-2022-33879 [MEDIUM] CVE-2022-33879: tika - The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the Standa...
The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate, new regex DoS in a different regex in the StandardsExtractingContentHandler. These are now fixed in 1.28.4 and 2.4.1.
Scope: local
bullseye: open
sid: open
Debian
CVE-2022-30973: tika - We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the 1.28.2 re...
vendor_debian·2022·CVSS 5.5
CVE-2022-30973 [MEDIUM] CVE-2022-30973: tika - We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the 1.28.2 re...
We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the 1.28.2 release. In Apache Tika, a regular expression in the StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler. This is fixed in 1.28.3.
Scope: local
bullseye: resolved
sid: resolved
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.openwall.com/lists/oss-security/2022/05/31/2http://www.openwall.com/lists/oss-security/2022/06/27/5https://lists.apache.org/thread/gqvb5t4p7tmdpl0y5bdbf72pgxj04h7phttps://security.netapp.com/advisory/ntap-20220722-0004/http://www.openwall.com/lists/oss-security/2022/05/31/2http://www.openwall.com/lists/oss-security/2022/06/27/5https://lists.apache.org/thread/gqvb5t4p7tmdpl0y5bdbf72pgxj04h7phttps://security.netapp.com/advisory/ntap-20220722-0004/
2022-05-31
Published