CVE-2018-11796: Apache Tika XML Entity Expansion Denial of Service
Summary
CVE-2018-11796: Apache Tika is vulnerable to entity expansions which can lead to a denial of service attack. Affects org.apache.tika:tika-core versions >= 0.1, < 1.19.1. Fixed in 1.19.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Tika is an open-source content analysis toolkit that provides a consistent interface for extracting metadata and text content from various file formats. It is widely used in applications that require content analysis and data extraction capabilities. The vulnerability identified as CVE-2018-11796 affects Apache Tika versions 0.1 to 1.19, specifically the 'tika-core' package.
Vulnerability Detail
The vulnerability in Apache Tika arises from the lack of proper handling of entity expansions during XML parsing. Although an entity expansion limit was introduced in version 1.19 to mitigate this issue, the reuse of SAXParsers and the subsequent call to reset() removes the user-specified SecurityManager, including the entity expansion limits, after the first parse. This oversight allows malicious XML input to trigger excessive entity expansions, leading to a denial of service (DoS) attack. The impact of this vulnerability can result in resource exhaustion, causing the affected application to become unresponsive or crash.
How To Fix
Latest published version: 4.1.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.19.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to Apache Tika version 1.19.1 or later.
Conclusion
The vulnerability identified as CVE-2018-11796 in Apache Tika's 'tika-core' package allows for a denial of service attack through XML entity expansions. Upgrading to Apache Tika version 1.19.1 or later is necessary to mitigate this vulnerability. It is crucial for users to promptly apply the recommended fix to ensure the security and stability of their applications. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tika:tika-core →
FAQ
Apache Tika is an open-source content analysis toolkit used for extracting metadata and text content from various file formats.
Apache Tika versions 0.1 to 1.19, specifically the 'tika-core' package, are vulnerable to this entity expansion DoS attack.
The vulnerability can be exploited to trigger a denial of service (DoS) attack, potentially causing resource exhaustion and application unresponsiveness or crashes.
To fix this vulnerability, it is recommended to upgrade to Apache Tika version 1.19.1 or any subsequent release.
No, there is no known workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tika:tika-core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
