Apache Tika 1.19 included an incomplete fix for CVE-2018-11761 which added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and thus removes entity expansion limits after the first parse. Apache Tika 1.19 is therefore still vulnerable to entity expansions which can lead to a denial of service attack.

External Reference:

https://lists.apache.org/thread.html/88de8350cda9b184888ec294c813c5bd8a2081de8fd3666f8904bc05@%3Cdev.tika.apache.org%3E

Upstream Issue:

https://issues.apache.org/jira/projects/TIKA/issues/TIKA-2727

Upstream Patch:

https://github.com/apache/tika/commit/86d4ba1e

In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.