Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Apache Tika XML Parsing Issue Allows for Denial of Service

CVE-2018-11761 · published 8 years ago
Summary

Apache Tika's XML parsing feature is not properly limited, allowing an attacker to intentionally flood the system with excessive data, potentially causing it to become unresponsive. This could disrupt the normal functioning of the application. Update to a fixed version of Apache Tika to resolve the issue.

What to do
  • Update apache org.apache.tika:tika-core to version 1.19.1.
Affected software
Ecosystem VendorProductAffected versions
maven apache org.apache.tika:tika-core >= 0.1, < 1.19.1
Fix: upgrade to 1.19.1
– apache tika >= 0.1, <= 1.18
cpe:2.3:a:apache:tika:*:*:*:*:*:*:*:*
– oracle business_process_management_suite 12.1.3.0.0
12.2.1.3.0
cpe:2.3:a:oracle:business_process_management_suite:12.1.3.0.0:*:*:*:*:*:*:*
Original advisory text
In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service ...
In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
9% chance of attack within 30 days
Type
CWE-611XML External Entity (XXE)
Timeline
Published19 Sep 2018
Updated15 Oct 2026
First seen6 Mar 2026
Sources
GHSA-6jq2-789q-fff2 · GHSA
CVE-2018-11761 · NVD
Track software like this
Free during beta