CVE-2022-25169: Apache Tika

Medium severity, CVSS 5.5. EPSS: 2.2% chance of exploitation in the next 30 days.

The BPG parser in versions of Apache Tika before 1.28.2 and 2.4.0 may allocate an unreasonable amount of memory on carefully crafted files.

Affected products

• Apache Tika: before 1.28.2 (fixed in 1.28.2); from 2.0.0, before 2.4.0 (fixed in 2.4.0)
• Oracle Primavera Unifier: from 17.7, up to and including 17.12; version 18.8 only; version 19.12 only; version 20.12 only; version 21.12 only

Published 2022-05-16. Last modified 2026-06-17.