CVE-2019-10094: Allocation of Resources Without Limits or Throttling in Apache Tika
Summary
CVE-2019-10094: Allocation of Resources Without Limits or Throttling in Apache Tika. Affects org.apache.tika:tika-core versions >= 1.7, < 1.22. Fixed in 1.22. How to fix ↓
Also tracked for
- tika · Debian:11
The same CVE-2019-10094 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tika is an open-source content analysis toolkit that is used to detect and extract metadata and text from various file formats. It is commonly used in applications that require parsing and analyzing different types of files. The vulnerability identified as CVE-2019-10094 affects the Apache Tika library versions 1.7 to 1.21. This vulnerability allows an attacker to cause a StackOverflowError by providing a specially crafted package or compressed file that, when uncompressed, results in a quine (a file that reproduces itself). This can lead to denial of service (DoS) attacks and potential system instability.
Vulnerability Detail
The vulnerability arises due to a lack of resource allocation limits or throttling in the RecursiveParserWrapper component of Apache Tika. When the malicious package or compressed file is processed, the RecursiveParserWrapper recursively calls itself, resulting in a stack overflow and causing the application to crash. This vulnerability can be exploited by an attacker to disrupt the availability of the affected application or system. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.8.
How To Fix
Latest published version: 4.1.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.22
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can implement their own resource allocation limits and throttling mechanisms when using the RecursiveParserWrapper component. This can be achieved by setting appropriate limits on the maximum recursion depth or the number of files processed. However, it is strongly advised to upgrade to the latest version of Apache Tika as soon as possible to fully mitigate the vulnerability.
Conclusion
The vulnerability identified as CVE-2019-10094 in Apache Tika versions 1.7 to 1.21 allows an attacker to cause a StackOverflowError by providing a specially crafted package or compressed file. This can result in denial of service (DoS) attacks and potential system instability. To mitigate this vulnerability, it is recommended to upgrade to Apache Tika version 1.22 or later. Implementing resource allocation limits and throttling mechanisms in the RecursiveParserWrapper component helps prevent stack overflow errors. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tika:tika-core →
FAQ
Apache Tika is an open-source content analysis toolkit used for parsing and extracting metadata from various file formats.
Versions 1.7 to 1.21 of Apache Tika are affected by this vulnerability.
A quine is a self-replicating program or file that produces an identical copy of itself as its output.
A StackOverflowError occurs when the call stack, which keeps track of method calls, exceeds its maximum limit, usually due to infinite recursion.
This vulnerability can lead to denial of service (DoS) attacks, system instability, and disruption of the affected application or system.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tika:tika-core.
