CVE-2020-1951: Infinite Loop in Apache Tika
Summary
CVE-2020-1951: Infinite Loop in Apache Tika. Affects org.apache.tika:tika versions >= 1.0, < 1.24. Fixed in 1.24. How to fix ↓
Also tracked for
- tika · Debian:11
The same CVE-2020-1951 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tika is an open-source content analysis toolkit that detects and extracts metadata and text from various file formats. It is commonly used in applications that require content analysis and data extraction capabilities. However, versions 1.0 to 1.23 of Apache Tika are vulnerable to an infinite loop when parsing specially crafted or corrupt PSD files using the PSDParser component.
Vulnerability Detail
The vulnerability in Apache Tika's PSDParser allows an attacker to trigger an infinite loop by providing a carefully crafted or corrupt PSD file. This can lead to a denial-of-service (DoS) condition, where the affected application becomes unresponsive or crashes. The vulnerability has a CVSS score of 5.5, indicating a moderate severity level. The Common Weakness Enumeration (CWE) ID associated with this vulnerability is CWE-835.
How To Fix
Latest published version: 4.1.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.24
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to apply the official fix by upgrading to Apache Tika version 1.24 or later.
Conclusion
In conclusion, the CVE-2020-1951 vulnerability in Apache Tika's PSDParser component can be exploited by providing a specially crafted or corrupt PSD file, leading to an infinite loop and a potential denial-of-service condition. To mitigate this vulnerability, it is crucial to upgrade to Apache Tika version 1.24 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tika:tika →
FAQ
Apache Tika is an open-source content analysis toolkit that provides functionality for detecting and extracting metadata and text from various file formats.
Versions 1.0 to 1.23 of Apache Tika are affected by this vulnerability.
This vulnerability can be exploited to cause a denial-of-service (DoS) condition in applications that use Apache Tika. The affected application may become unresponsive or crash.
Yes, a fix is available in Apache Tika version 1.24 or later. It is recommended to upgrade to the fixed version to mitigate the vulnerability.
No, there is no known workaround for this vulnerability. Upgrading to the fixed version is necessary.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tika:tika.
