CVE-2022-30126: Apache Tika Regular Expression Denial of Service in Standards Extractor
In Apache Tika, a regular expression in our StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler.
Reference:
http://www.openwall.com/lists/oss-security/2022/05/16/3
Other sources
In Apache Tika, a regular expression in our StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler.
This was originally fixed in 1.28.2 and 2.4.0. While the fix in version 2.4.0 was complete, the fix for the 1.x branch wasn't incorporated until version 1.28.3. Please see GHSA-qw3f-w4pf-jh5f for more information.
In Apache Tika, a regular expression in our StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler. This is fixed in 1.28.2 and 2.4.0
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-30126.
What is the severity of CVE-2022-30126?
The severity of CVE-2022-30126 is medium with a CVSS score of 5.5.
How does Apache Tika CVE-2022-30126 vulnerability occur?
The CVE-2022-30126 vulnerability in Apache Tika occurs due to a regular expression in the StandardsText class, which can lead to a denial of service caused by backtracking on a specially crafted file.
Which versions of Apache Tika are affected by CVE-2022-30126?
Versions 1.17 to 1.28.2 and versions 2.0.0 to 2.4.0 of Apache Tika are affected by CVE-2022-30126.
How can I fix the Apache Tika CVE-2022-30126 vulnerability?
To fix the Apache Tika CVE-2022-30126 vulnerability, you should update your Apache Tika version to 1.28.2 or higher for versions 1.x and to 2.4.0 or higher for versions 2.x.