Apache Tika Regular Expression Denial of Service in Standards Extractor
CVE-2022-30126

5.5MEDIUM

Key Information:

Vendor: Apache
Status: Apache Tika
Vendor: CVE Published:; 16 May 2022

Summary

In Apache Tika, a regular expression in our StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler. This is fixed in 1.28.2 and 2.4.0

Affected Version(s)

Apache Tika Apache Tika <= 1.28.1

References

https://lists.apache.org/thread/dh3syg68nxogbmlg13srd6gjn...

x_refsource_MISC

http://www.openwall.com/lists/oss-security/2022/05/16/3

mailing-listx_refsource_MLIST

http://www.openwall.com/lists/oss-security/2022/05/31/2

mailing-listx_refsource_MLIST

CVSS V3.1

Score:

5.5

Severity:

MEDIUM

Confidentiality:

None

Integrity:

None

Availability:

None

Attack Vector:

Local

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Unchanged

Timeline

Vulnerability published
May 16, 2022
Vulnerability Reserved
May 3, 2022

Credit

This issue was discovered and reported by the CodeQL team members [@atorralba (Tony Torralba)](https://github.com/atorralba) and [@joefarebrother (Joseph Farebrother)](https://github.com/joefarebrother).