CVE-2018-11761
High severity vulnerability that affects org.apache.tika:tika-core
7.5 HighPublic exploitFix available
In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
9.38%Down 5.7 points since Apr 14, 2021
What each source reports
NVD Score used
In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.
- Record
CVE-2018-11761- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-611
- Updated
- 2026-11-02
CVE List No score
In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.
- Record
CVE-2018-11761- Updated
- 2026-11-02
EUVDEUVD-2018-0520 No score
In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.
- Record
EUVD-2018-0520- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6jq2-789q-fff2
High severity vulnerability that affects org.apache.tika:tika-core
In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.
- Record
GHSA-6jq2-789q-fff2- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-611
- Updated
- 2026-11-02
OSV
In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.
- Record
CVE-2018-11761- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-11761
In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.
- Record
DEBIAN-CVE-2018-11761- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-6jq2-789q-fff2
High severity vulnerability that affects org.apache.tika:tika-core
In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.
- Record
GHSA-6jq2-789q-fff2- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-611
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-11761
In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.
- Record
UBUNTU-CVE-2018-11761- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-06
OSVSUSE-RU-2018:4018-1 No score
Security update for SUSE Manager Server 3.2
This update fixes the following issues:
apache-mybatis:
- Install missing LICENSE.txt file (bsc#1114814)
cobbler:
- Fix service restart after logrotate for cobblerd (bsc#1113747)
- Rotate cobbler logs at higher frequency to prevent disk fillup (bsc#1113747)
hadoop:
- Install missing LICENSE.txt file (bsc#1114814)
image-sync-formula:
- Handle empty images pillar (bsc#1105359)
lucene:
- Install missing LICENSE.txt file (bsc#1114814)
nekohtml:
- Install missing LICENSE.txt file (bsc#1114814)
nutch-core:
- Install missing LICENSE.txt file (bsc#1114814)
- Add conditional requirement for java 1.8
- Use java >= 1.8 - required by tika 0.19.1 to /var/log/nutch (bsc#1107869)
- Add new tarball file for v1.0.1
- Bump up version to 1.0.1 and fix paths
- Adjustments after upgrade of tika-core to v1.19
picocontainer:
- Install missing LICENSE.txt file (bsc#1114814)
python-susemanager-retail:
- Improve error reporting on duplicate systems
- Output partition size as int (bsc#1116517)
- Start partition numbers from 1
- Warn on long group names
- Improved logging support
- Add retail_yaml --only-new option
- Print import summary (bsc#1112754)
- Add retail_migration tool
- Check for duplicate addresses in yaml (bsc#1111497)
salt-netapi-client:
- Version 0.15.0 See: https://github.com/SUSE/salt-netapi-client/releases/tag/v0.15.0
saltboot-formula:
- Send pxe_update by external command to make sure it is finished (bsc#1111387)
- Better error message on missing partitioning pillar (bsc#1110625)
spacecmd:
- Show group id on group_details (bsc#1111542)
- State channels handling: Existing commands configchannel_create and configchannel_import were updated while system_scheduleapplyconfigchannels and configchannel_updateinitsls were added.
spacewalk-branding:
- Automatic cleanup of notification messages after a configurable lifetime
- ActivationKey base and child channel in a reactjs component
- New messages are added for XMLRPC API for state channels
spacewalk-config:
- Add permissions for tomcat & apache to check bootstrap ssh file (bsc#1114181)
spacewalk-java:
- Improve return value and errors thrown for system.createEmptyProfile XMLRPC endpoint
- Fix scheduling jobs to prevent forever pending events (bsc#1114991)
- Performance improvements for group listings and detail page (bsc#1111810)
- Fix wrong counts of systems currency reports when a system belongs to more than one group (bsc#1114362)
- Add check if ssh-file permissions are correct (bsc#1114181)
- Increase maximum number of threads and open files for taskomatic (bsc#1111966)
- When removing cobbler system record, lookup by mac address as well if lookup by id fails(bsc#1110361)
- Allow listing empty system profiles via XMLRPC
- Automatic cleanup of notification messages after a configurable lifetime
- Different methods have been refactored in tomcat/taskomatic for better performance(bsc#1106430)
- Do not try cleanup when deleting empty system profiles (bsc#1111247)
- Better error handling when a websocket connection is aborted (bsc#1080474)
- Change Requires to allow installing with both Tomcat 8 (SLE-12SP3) and 9 (SLE12-SP4)
- ActivationKey base and child channel in a reactjs component
- Fix typo in messages (bsc#1111249)
- Cleanup formula data and assignment when migrating formulas or when removing system
- Remove restrictions on SUSE Manager Channel subscriptions (bsc#1105724)
- Added shortcut for editing Software Channel
- Fix permissions check on formula list api call (bsc#1106626)
- Add sp migration dry runs to the daily status report (bsc#1083094)
spacewalk-search:
- Fix nutch-core path (bsc#1112445)
spacewalk-setup:
- Increase maximum number of threads and open files for taskomatic (bsc#1111966)
spacewalk-utils:
- Fix typo at --phases option help
spacewalk-web:
- Make datetimepicker update displayed time (bsc#1041999)
- Show human-readable system cleanup error messages
- ActivationKey base and child channel in a reactjs component -…
- Record
SUSE-RU-2018:4018-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:4011-1 No score
Security update for SUSE Manager Server 3.2
This update fixes the following issues:
apache-mybatis:
- Install missing LICENSE.txt file (bsc#1114814)
cobbler:
- Fix service restart after logrotate for cobblerd (bsc#1113747)
- Rotate cobbler logs at higher frequency to prevent disk fillup (bsc#1113747)
hadoop:
- Install missing LICENSE.txt file (bsc#1114814)
image-sync-formula:
- Handle empty images pillar (bsc#1105359)
lucene:
- Install missing LICENSE.txt file (bsc#1114814)
nekohtml:
- Install missing LICENSE.txt file (bsc#1114814)
nutch-core:
- Install missing LICENSE.txt file (bsc#1114814)
- Add conditional requirement for java 1.8
- Use java >= 1.8 - required by tika 0.19.1 to /var/log/nutch (bsc#1107869)
- Add new tarball file for v1.0.1
- Bump up version to 1.0.1 and fix paths
- Adjustments after upgrade of tika-core to v1.19
picocontainer:
- Install missing LICENSE.txt file (bsc#1114814)
python-susemanager-retail:
- Improve error reporting on duplicate systems
- Output partition size as int (bsc#1116517)
- Start partition numbers from 1
- Warn on long group names
- Improved logging support
- Add retail_yaml --only-new option
- Print import summary (bsc#1112754)
- Add retail_migration tool
- Check for duplicate addresses in yaml (bsc#1111497)
salt-netapi-client:
- Version 0.15.0 See: https://github.com/SUSE/salt-netapi-client/releases/tag/v0.15.0
saltboot-formula:
- Send pxe_update by external command to make sure it is finished (bsc#1111387)
- Better error message on missing partitioning pillar (bsc#1110625)
spacecmd:
- Show group id on group_details (bsc#1111542)
- State channels handling: Existing commands configchannel_create and configchannel_import were updated while system_scheduleapplyconfigchannels and configchannel_updateinitsls were added.
spacewalk-branding:
- Automatic cleanup of notification messages after a configurable lifetime
- ActivationKey base and child channel in a reactjs component
- New messages are added for XMLRPC API for state channels
spacewalk-config:
- Add permissions for tomcat & apache to check bootstrap ssh file (bsc#1114181)
spacewalk-java:
- Improve return value and errors thrown for system.createEmptyProfile XMLRPC endpoint
- Fix scheduling jobs to prevent forever pending events (bsc#1114991)
- Performance improvements for group listings and detail page (bsc#1111810)
- Fix wrong counts of systems currency reports when a system belongs to more than one group (bsc#1114362)
- Add check if ssh-file permissions are correct (bsc#1114181)
- Increase maximum number of threads and open files for taskomatic (bsc#1111966)
- When removing cobbler system record, lookup by mac address as well if lookup by id fails(bsc#1110361)
- Allow listing empty system profiles via XMLRPC
- Automatic cleanup of notification messages after a configurable lifetime
- Different methods have been refactored in tomcat/taskomatic for better performance(bsc#1106430)
- Do not try cleanup when deleting empty system profiles (bsc#1111247)
- Better error handling when a websocket connection is aborted (bsc#1080474)
- Change Requires to allow installing with both Tomcat 8 (SLE-12SP3) and 9 (SLE12-SP4)
- ActivationKey base and child channel in a reactjs component
- Fix typo in messages (bsc#1111249)
- Cleanup formula data and assignment when migrating formulas or when removing system
- Remove restrictions on SUSE Manager Channel subscriptions (bsc#1105724)
- Added shortcut for editing Software Channel
- Fix permissions check on formula list api call (bsc#1106626)
- Add sp migration dry runs to the daily status report (bsc#1083094)
spacewalk-search:
- Fix nutch-core path (bsc#1112445)
spacewalk-setup:
- Increase maximum number of threads and open files for taskomatic (bsc#1111966)
spacewalk-utils:
- Fix typo at --phases option help
spacewalk-web:
- Make datetimepicker update displayed time (bsc#1041999)
- Show human-readable system cleanup error messages
- ActivationKey base and child channel in a reactjs component -…
- Record
SUSE-SU-2018:4011-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.tika:tika-coreMaven |
0.1 up to 1.19.1 | 1.19.1 |
tikaDebian:11 |
before 1.20-1 | 1.20-1 |
org.apache.tika:tika-coreMaven |
0.1 up to 1.19.1, plus listed versions 0.100.40.50.60.7 Show 22 moreShow less0.80.91.01.11.101.111.121.131.141.151.161.171.181.191.21.31.41.51.61.71.81.9 |
1.19.1 |
spacewalk-webSUSE:Manager Proxy 3.2 |
before 2.8.7.11-3.13.3 | 2.8.7.11-3.13.3 |
apache-mybatisSUSE:Manager Server 3.2 |
before 3.2.3-3.3.3 | 3.2.3-3.3.3 |
cobblerSUSE:Manager Server 3.2 |
before 2.6.6-6.10.3 | 2.6.6-6.10.3 |
hadoopSUSE:Manager Server 3.2 |
before 0.18.1-3.3.3 | 0.18.1-3.3.3 |
image-sync-formulaSUSE:Manager Server 3.2 |
before 0.1.1542287363.b8aa274-3.6.3 | 0.1.1542287363.b8aa274-3.6.3 |
luceneSUSE:Manager Server 3.2 |
before 2.4.1-4.3.3 | 2.4.1-4.3.3 |
nekohtmlSUSE:Manager Server 3.2 |
before 1.9.21-3.3.3 | 1.9.21-3.3.3 |
Show 24 moreShow less
| Package | Affected | Fixed |
|---|---|---|
nutch-coreSUSE:Manager Server 3.2 |
before 1.0.1-7.10.3 | 1.0.1-7.10.3 |
picocontainerSUSE:Manager Server 3.2 |
before 1.3.7-3.3.3 | 1.3.7-3.3.3 |
python-susemanager-retailSUSE:Manager Server 3.2 |
before 1.0.1542643545.8752d17-2.6.3 | 1.0.1542643545.8752d17-2.6.3 |
salt-netapi-clientSUSE:Manager Server 3.2 |
before 0.15.0-4.3.3 | 0.15.0-4.3.3 |
saltboot-formulaSUSE:Manager Server 3.2 |
before 0.1.1542287363.b8aa274-3.6.3 | 0.1.1542287363.b8aa274-3.6.3 |
spacecmdSUSE:Manager Server 3.2 |
before 2.8.25.7-3.9.3 | 2.8.25.7-3.9.3 |
spacewalk-brandingSUSE:Manager Server 3.2 |
before 2.8.5.12-3.10.4 | 2.8.5.12-3.10.4 |
spacewalk-configSUSE:Manager Server 3.2 |
before 2.8.5.5-3.10.3 | 2.8.5.5-3.10.3 |
spacewalk-javaSUSE:Manager Server 3.2 |
before 2.8.78.13-3.13.1 | 2.8.78.13-3.13.1 |
spacewalk-searchSUSE:Manager Server 3.2 |
before 2.8.3.7-3.12.3 | 2.8.3.7-3.12.3 |
spacewalk-setupSUSE:Manager Server 3.2 |
before 2.8.7.5-3.10.3 | 2.8.7.5-3.10.3 |
spacewalk-utilsSUSE:Manager Server 3.2 |
before 2.8.18.3-3.3.3 | 2.8.18.3-3.3.3 |
spacewalk-webSUSE:Manager Server 3.2 |
before 2.8.7.11-3.13.3 | 2.8.7.11-3.13.3 |
susemanagerSUSE:Manager Server 3.2 |
before 3.2.14-3.13.3 | 3.2.14-3.13.3 |
susemanager-docs_enSUSE:Manager Server 3.2 |
before 3.2-11.12.3 | 3.2-11.12.3 |
susemanager-frontend-libsSUSE:Manager Server 3.2 |
before 3.2.4-3.7.3 | 3.2.4-3.7.3 |
susemanager-schemaSUSE:Manager Server 3.2 |
before 3.2.15-3.13.3 | 3.2.15-3.13.3 |
susemanager-slsSUSE:Manager Server 3.2 |
before 3.2.18-3.13.3 | 3.2.18-3.13.3 |
susemanager-sync-dataSUSE:Manager Server 3.2 |
before 3.2.10-3.9.3 | 3.2.10-3.9.3 |
tika-coreSUSE:Manager Server 3.2 |
before 1.19.1-3.3.3 | 1.19.1-3.3.3 |
tikaUbuntu:16.04:LTS |
All versions, plus listed versions 1.5-21.5-31.5-41.5-4ubuntu0.1 |
None known |
tikaUbuntu:18.04:LTS |
All versions, plus listed versions 1.5-5 |
None known |
tikaUbuntu:25.10 |
All versions, plus listed versions 1.22-2 |
None known |
tikaUbuntu:26.10 |
All versions, plus listed versions 1.22-2 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | brianwrf/CVE-2018-11761 | 2019-01-23 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-11761 is a high vulnerability (CVSS 7.5) in Apache Tika, published September 19, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 9.38%, the 95th percentile. Fixed in org.apache.tika:tika-core 1.19.1.
References
securityfocus.com/bid/105514
lists.apache.org/thread.html/5553e10bba5604117967466618f219c0cae710075819c70cfb3fb421%40%3Cdev.tika.apache.org%3E
oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
nvd.nist.gov/vuln/detail/CVE-2018-11761
github.com/advisories/GHSA-6jq2-789q-fff2
Show 39 moreShow less
security-tracker.debian.org/tracker/CVE-2018-11761
suse.com/support/update/announcement//suse-ru-20184018-1
bugzilla.suse.com/1041999
ubuntu.com/security/CVE-2018-11761
openwall.com/lists/oss-security/2018/09/19/4
cve.org/CVERecord?id=CVE-2018-11761
This page doesn't list everything
Left out here: the rest of 2 source descriptions. The JSON record has them.