CVE-2022-30126: Apache Tika

Medium severity, CVSS 5.5. EPSS: 2.6% chance of exploitation in the next 30 days.

In Apache Tika, a regular expression in our StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler. This is fixed in 1.28.2 and 2.4.0

Affected products

• Apache Tika: before 1.28.3 (fixed in 1.28.3); from 2.0.0, before 2.4.0 (fixed in 2.4.0)
• Oracle Primavera Unifier: from 17.7, up to and including 17.12; version 18.8 only; version 19.12 only; version 20.12 only; version 21.12 only

Published 2022-05-16. Last modified 2026-06-17.