VDB

CVE-2019-10093

CVE-2019-10093 PUBLISHED CVSS 6.5 MEDIUM

Allocation of Resources Without Limits or Throttling in Apache Tika

Reported by apache · Published August 2, 2019

In Apache Tika 1.19 to 1.21, a carefully crafted 2003ml or 2006ml file could consume all available SAXParsers in the pool and lead to very long hangs. Apache Tika users should upgrade to 1.22 or later.

Risk scores

CVSS 3.0
6.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products

VendorProductVersions
ApacheApache Tika1.19 to 1.21
ApacheApache Tika1.19
Mavenorg.apache.tika:tika-parsers1.19
Mavenorg.apache.tika:tika-core1.19

Timeline

  • Aug 2, 2019 CVE Published
  • Apr 14, 2021 EPSS Score (30 in total, the first dated here)
  • Nov 21, 2024 CVE Updated
  • Mar 18, 2026 Security Advisory
  • Sep 17, 2026 Coalition ESS Score

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2019-10093
vulnetix vdb fixes CVE-2019-10093

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2019-10093/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›