CVE-2023-34150: Apache Any23 Excessive Memory Usage

org.apache.any23:apache-any23 Updated 02 Oct 2025

Summary

05/07/2023

Disclosed on

CVE-2023-34150

CVE

No i

Fix available

Moderate

Severity

6.5

CVSS Score

CVE-2023-34150: Apache Any23 vulnerable to excessive memory usage. Affects org.apache.any23:apache-any23 versions < 2.7. No fix is published. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Apache Any23 is a Java library and command-line tool that extracts structured data in RDF format from various web documents. It provides functionality for parsing, validating, and extracting metadata from HTML, XML, CSV, JSON, and other formats. The vulnerability in Apache Any23 arises from the use of TikaEncodingDetector, which can lead to excessive memory usage.

Vulnerability Detail

The vulnerability in Apache Any23 allows an attacker to cause excessive memory usage. This can be exploited by sending specially crafted input to the TikaEncodingDetector, which is used for detecting character encodings. By manipulating the input, an attacker can trigger a memory leak or exhaustion, potentially leading to denial of service or other adverse effects. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.

How To Fix

No fixed version is published for this vulnerability.

Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →

Workaround

There is no known workaround for this vulnerability. It is necessary to update to a fixed version of Apache Any23 to mitigate the issue.

Conclusion

The vulnerability in Apache Any23 allows for excessive memory usage, which can be exploited to cause denial of service or other adverse effects. To mitigate this vulnerability, it is crucial to update Apache Any23 to version 2.8 or a later version. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for org.apache.any23:apache-any23 →