{"id":"CVE-2022-30126","published":"2022-05-16T17:05:13Z","modified":"2024-08-03T06:40:47Z","title":"Apache Tika Regular Expression Denial of Service in Standards Extractor","vendor":"Apache","product":"Apache Tika","tier":"tail","description":{"text":"In Apache Tika, a regular expression in our StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler. This is fixed in 1.28.2 and 2.4.0","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.02598,"percentile":0.85281,"provenance":"source"},"cwes":[],"references":[{"url":"https://lists.apache.org/thread/dh3syg68nxogbmlg13srd6gjn3h2z6r4","tags":["x_refsource_MISC"]},{"url":"http://www.openwall.com/lists/oss-security/2022/05/16/3","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.openwall.com/lists/oss-security/2022/05/31/2","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.openwall.com/lists/oss-security/2022/06/27/5","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20220624-0004/","tags":["x_refsource_CONFIRM"]}],"priority":{"score":17.1,"factors":[{"name":"EPSS percentile","points":17.06}]},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Tika","versions":[">= Apache Tika, <= 1.28.1"]}],"affected":[{"ecosystem":"Maven","package":"org.apache.tika:tika-core","vulnerableRanges":[">=1.17, <1.28.2",">=2.0.0, <2.4.0"],"patched":["1.28.2","2.4.0"],"from":["GHSA-rpjm-422r-95mh"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-5214","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-apache-tika-cve-2022-30126","children":[{"from":"CVE-2022-30126","to":"CVE-2022-30973","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-qw3f-w4pf-jh5f","via":"reference","url":"https://github.com/advisories/GHSA-rpjm-422r-95mh"},{"kind":"osv-related","provenance":"source","id":"GHSA-rpjm-422r-95mh","via":"reference","url":"https://github.com/advisories/GHSA-qw3f-w4pf-jh5f"},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tika:tika-core","fromFixed":"1.28.2","toFixed":"1.28.3","daysApart":15},{"kind":"similar","provenance":"machine","score":0.91,"basis":"same product + description similarity"}]},{"from":"CVE-2022-30126","to":"CVE-2022-33879","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate, new regex DoS in a different regex in the StandardsExtractingContentHandler.","from":"CVE.org","in":"CVE-2022-33879"},{"kind":"similar","provenance":"machine","score":0.48,"basis":"same product + description similarity"}]}],"packageHistory":[{"cve":"CVE-2019-10088","published":"2019-08-02","fixed":"1.22","kev":false},{"cve":"CVE-2019-10094","published":"2019-08-02","fixed":"1.22","kev":false},{"cve":"CVE-2022-30973","published":"2022-05-31","fixed":"1.28.3","kev":false},{"cve":"CVE-2022-30126","published":"2022-05-16","fixed":"2.4.0","kev":false},{"cve":"CVE-2025-66516","published":"2025-12-04","fixed":"3.2.2","kev":false}],"package":"Maven:org.apache.tika:tika-core"}}