{"id":"CVE-2019-10094","aliases":["DEBIAN-CVE-2019-10094","EUVD-2019-0639","GHSA-mm7m-xg4h-6m52","SUSE-SU-2019:2521-1","SUSE-SU-2019:2930-1"],"status":"published","title":"Allocation of Resources Without Limits or Throttling in Apache Tika","description":"A carefully crafted package/compressed file that, when unzipped/uncompressed yields the same file (a quine), causes a StackOverflowError in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Apache Tika users should upgrade to 1.22 or later.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02457,"percentile":0.8456,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2019-08-02T18:37:52Z","modified":"2026-10-24T10:30:34Z","fixes":[{"ecosystem":"Maven","package":"org.apache.tika:tika-core","fixed_in":["1.22"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:11","package":"tika","fixed_in":["1.22-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tika:tika-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.22"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"tika","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22-1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tika:tika-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.22"}]}],"versions":["1.10","1.11","1.12","1.13","1.14","1.15","1.16","1.17","1.18","1.19","1.19.1","1.20","1.21","1.7","1.8","1.9"]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.6-6.22.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"pgjdbc-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.1-2.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"py26-compat-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.10-6.32.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.25.11-3.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.57.19-3.39.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-branding","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5.16-3.22.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.22.5-3.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.78.24-3.38.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-setup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.7.8-3.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.18.5-3.9.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.7.19-3.36.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.20-3.31.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"susemanager-docs_en","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2-11.32.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"susemanager-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.21-3.31.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"susemanager-sls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.27-3.35.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"tika-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22-3.9.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0+git20190806.32c4bae0-7.3.7"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"cpu-mitigations-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1-4.6.7"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"mgr-osad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.10-3.6.8"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"patterns-suse-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-9.3.8"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"pgjdbc-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.1-3.3.8"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"prometheus-exporters-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4-3.3.7"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"pxe-default-image-sle15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-20191106084601"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"py26-compat-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.10-10.8.8"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"python-susemanager-retail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1568808472.be9f236-3.6.7"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"python-urlgrabber","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.2.1py2_3-6.22.6"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.16-3.6.7"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8-3.3.8"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.27-3.13.9"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-branding","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.14-3.6.8"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-certs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.12-3.6.8"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.10-3.6.8"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.13-3.3.7"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.25-3.10.5"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-setup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.11-3.6.7"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.13-3.6.8"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.16-3.9.8"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.17-3.6.9"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"susemanager-doc-indexes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-10.9.8"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"susemanager-docs_en","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-10.9.7"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"susemanager-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.16-3.8.5"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"susemanager-sls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.22-3.10.4"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"susemanager-sync-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.13-3.6.7"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"tika-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22-3.3.7"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"virtual-host-gatherer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.19-3.3.8"}]}],"bundled":3}],"products":[{"vendor":"apache","product":"apache tika"},{"vendor":"apache","product":"tika"},{"vendor":"apache software foundation","product":"apache tika"}],"references":[{"url":"https://lists.apache.org/thread.html/fe876a649d9d36525dd097fe87ff4dcb3b82bb0fbb3a3d71fb72ef61%40%3Cdev.tika.apache.org%3E","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/fb6c84fd387de997e5e366d50b0ca331a328c466432c80f8c5eed33d%40%3Cdev.tika.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/da9ee189d1756f8508d0f2386d8e25aca5a6df541739829232be8a94%40%3Cdev.tika.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/39723d8227b248781898c200aa24b154683673287b150a204b83787d%40%3Cdev.tika.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10094","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/fe876a649d9d36525dd097fe87ff4dcb3b82bb0fbb3a3d71fb72ef61@%3Cdev.tika.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/39723d8227b248781898c200aa24b154683673287b150a204b83787d@%3Cdev.tika.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/da9ee189d1756f8508d0f2386d8e25aca5a6df541739829232be8a94@%3Cdev.tika.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/fb6c84fd387de997e5e366d50b0ca331a328c466432c80f8c5eed33d@%3Cdev.tika.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5@%3Csolr-user.lucene.apache.org%3E","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mm7m-xg4h-6m52"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-10094","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192521-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1093381","tags":["report"]},{"url":"https://bugzilla.suse.com/1096426","tags":["report"]},{"url":"https://bugzilla.suse.com/1135957","tags":["report"]},{"url":"https://bugzilla.suse.com/1137229","tags":["report"]},{"url":"https://bugzilla.suse.com/1138454","tags":["report"]},{"url":"https://bugzilla.suse.com/1140644","tags":["report"]},{"url":"https://bugzilla.suse.com/1141661","tags":["report"]},{"url":"https://bugzilla.suse.com/1142309","tags":["report"]},{"url":"https://bugzilla.suse.com/1142764","tags":["report"]},{"url":"https://bugzilla.suse.com/1142774","tags":["report"]},{"url":"https://bugzilla.suse.com/1143016","tags":["report"]},{"url":"https://bugzilla.suse.com/1143562","tags":["report"]},{"url":"https://bugzilla.suse.com/1144500","tags":["report"]},{"url":"https://bugzilla.suse.com/1144510","tags":["report"]},{"url":"https://bugzilla.suse.com/1144515","tags":["report"]},{"url":"https://bugzilla.suse.com/1144889","tags":["report"]},{"url":"https://bugzilla.suse.com/1145086","tags":["report"]},{"url":"https://bugzilla.suse.com/1145119","tags":["report"]},{"url":"https://bugzilla.suse.com/1146416","tags":["report"]},{"url":"https://bugzilla.suse.com/1146419","tags":["report"]},{"url":"https://bugzilla.suse.com/1146869","tags":["report"]},{"url":"https://bugzilla.suse.com/1146895","tags":["report"]},{"url":"https://bugzilla.suse.com/1147126","tags":["report"]},{"url":"https://bugzilla.suse.com/1149409","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10094","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192930-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1133429","tags":["report"]},{"url":"https://bugzilla.suse.com/1135442","tags":["report"]},{"url":"https://bugzilla.suse.com/1136959","tags":["report"]},{"url":"https://bugzilla.suse.com/1138358","tags":["report"]},{"url":"https://bugzilla.suse.com/1143789","tags":["report"]},{"url":"https://bugzilla.suse.com/1144300","tags":["report"]},{"url":"https://bugzilla.suse.com/1145551","tags":["report"]},{"url":"https://bugzilla.suse.com/1145587","tags":["report"]},{"url":"https://bugzilla.suse.com/1145626","tags":["report"]},{"url":"https://bugzilla.suse.com/1145744","tags":["report"]},{"url":"https://bugzilla.suse.com/1145750","tags":["report"]},{"url":"https://bugzilla.suse.com/1145753","tags":["report"]},{"url":"https://bugzilla.suse.com/1145758","tags":["report"]},{"url":"https://bugzilla.suse.com/1145769","tags":["report"]},{"url":"https://bugzilla.suse.com/1145873","tags":["report"]},{"url":"https://bugzilla.suse.com/1146683","tags":["report"]},{"url":"https://bugzilla.suse.com/1148169","tags":["report"]},{"url":"https://bugzilla.suse.com/1149075","tags":["report"]},{"url":"https://bugzilla.suse.com/1149210","tags":["report"]},{"url":"https://bugzilla.suse.com/1149353","tags":["report"]},{"url":"https://bugzilla.suse.com/1149425","tags":["report"]},{"url":"https://bugzilla.suse.com/1149633","tags":["report"]},{"url":"https://bugzilla.suse.com/1150113","tags":["report"]},{"url":"https://bugzilla.suse.com/1150154","tags":["report"]},{"url":"https://bugzilla.suse.com/1150180","tags":["report"]},{"url":"https://bugzilla.suse.com/1150314","tags":["report"]},{"url":"https://bugzilla.suse.com/1150729","tags":["report"]},{"url":"https://bugzilla.suse.com/1151097","tags":["report"]},{"url":"https://bugzilla.suse.com/1151280","tags":["report"]},{"url":"https://bugzilla.suse.com/1151399","tags":["report"]},{"url":"https://bugzilla.suse.com/1151467","tags":["report"]},{"url":"https://bugzilla.suse.com/1151481","tags":["report"]},{"url":"https://bugzilla.suse.com/1151666","tags":["report"]},{"url":"https://bugzilla.suse.com/1151875","tags":["report"]},{"url":"https://bugzilla.suse.com/1152170","tags":["report"]},{"url":"https://bugzilla.suse.com/1152290","tags":["report"]},{"url":"https://bugzilla.suse.com/1152514","tags":["report"]},{"url":"https://bugzilla.suse.com/1152735","tags":["report"]},{"url":"https://bugzilla.suse.com/1153277","tags":["report"]},{"url":"https://bugzilla.suse.com/1153578","tags":["report"]},{"url":"https://bugzilla.suse.com/1154275","tags":["report"]},{"url":"https://bugzilla.suse.com/1155656","tags":["report"]},{"url":"https://bugzilla.suse.com/1155794","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-10094","description":"A carefully crafted package/compressed file that, when unzipped/uncompressed yields the same file (a quine), causes a StackOverflowError in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Apache Tika users should upgrade to 1.22 or later.","status":"published","published":"2019-08-02T18:37:52Z","modified":"2024-08-04T22:10:09.434Z","updated_at":"2026-11-02T14:20:19.056416Z"}],"euvd":[{"id":"EUVD-2019-0639","description":"A carefully crafted package/compressed file that, when unzipped/uncompressed yields the same file (a quine), causes a StackOverflowError in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Apache Tika users should upgrade to 1.22 or later.","status":"published","published":"2019-08-02T18:37:52Z","modified":"2024-08-04T22:10:09Z","updated_at":"2026-11-03T02:40:54.154728Z"}],"ghsa":[{"id":"GHSA-mm7m-xg4h-6m52","title":"Allocation of Resources Without Limits or Throttling in Apache Tika","description":"A carefully crafted package/compressed file that, when unzipped/uncompressed yields the same file (a quine), causes a StackOverflowError in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Apache Tika users should upgrade to 1.22 or later.","status":"published","published":"2019-08-06T01:43:35Z","modified":"2023-02-01T05:02:22Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:36:30.61364Z"}],"nvd":[{"id":"CVE-2019-10094","description":"A carefully crafted package/compressed file that, when unzipped/uncompressed yields the same file (a quine), causes a StackOverflowError in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Apache Tika users should upgrade to 1.22 or later.","status":"published","published":"2019-08-02T19:15:11.857Z","modified":"2026-06-17T02:10:13.313Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:05:21.892729Z"}],"osv":[{"id":"CVE-2019-10094","description":"A carefully crafted package/compressed file that, when unzipped/uncompressed yields the same file (a quine), causes a StackOverflowError in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Apache Tika users should upgrade to 1.22 or later.","status":"published","published":"2019-08-02T19:15:11.857Z","modified":"2026-10-24T10:30:34.262391384Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:10.051046Z"},{"id":"DEBIAN-CVE-2019-10094","description":"A carefully crafted package/compressed file that, when unzipped/uncompressed yields the same file (a quine), causes a StackOverflowError in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Apache Tika users should upgrade to 1.22 or later.","status":"published","published":"2019-08-02T19:15:11.857Z","modified":"2026-08-29T07:00:14.614630793Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.170944Z"},{"id":"GHSA-mm7m-xg4h-6m52","title":"Allocation of Resources Without Limits or Throttling in Apache Tika","description":"A carefully crafted package/compressed file that, when unzipped/uncompressed yields the same file (a quine), causes a StackOverflowError in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Apache Tika users should upgrade to 1.22 or later.","status":"published","published":"2019-08-06T01:43:35Z","modified":"2023-11-08T04:00:40.35487Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:52.170928Z"},{"id":"SUSE-SU-2019:2521-1","title":"Security update for SUSE Manager Server 3.2","description":"\nThis update fixes the following issues:\n\ncobbler:\n\n- Jinja2 template library fix (bsc#1141661)\n\npgjdbc-ng:\n\n- Allow dots in database name (bsc#1146416) \n\npy26-compat-salt:\n\n- Get tornado dependency from the system on SLE12 (bsc#1149409) \n- Catch SSLError for TLS 1.2 bootstraps with RES/RHEL6 and SLE11 (bsc#1147126)\n\nspacecmd:\n\n- Check that a channel doesn't have clones before deleting it (bsc#1138454)\n\nspacewalk-backend:\n\n- Remove credentials also from potential rhn.conf backup files in spacewalk-debug (bsc#1146419)\n- Do not make 'rhn-satellite-exporter' to crash with 'AttributeError' (bsc#1146869)\n- Spacewalk-remove-channel check that channel doesn't have cloned channels before deleting it (bsc#1138454)\n- Prevent duplicate changelog entries due VARCHAR(3000)\n  db text column (bsc#1144889)\n- Avoid traceback on mgr-inter-sync when exception message\n  contains UTF8 characters or there are problems with the\n  package cache (bsc#1143016)\n  registered guest (bsc#1093381)\n\nspacewalk-branding:\n\n- Add missing strings for task status page\n\nspacewalk-client-tools:\n\n- Invalidate cache 5 minutes before actual expiration(bsc#1143562)\n\nspacewalk-java:\n\n- Add UI message when salt-formulas system folders are unreachable (bsc#1142309)\n- Don't convert localhost repositories URL in mirror case (bsc#1135957)\n- Check that a channel doesn't have clones before deleting it (bsc#1138454)\n- Improve websocket authentication to prevent errors in logs (bsc#1138454)\n- Normalize date formats for actions, notifications and clm (bsc#1142774)\n- Cloning Errata from a specific channel should not take packages\n  from other channels (bsc#1142764)\n- Add susemanager as prerequired for spacewalk-java\n- Improve performance for retrieving the user permissions on channels (bsc#1140644)\n- Prerequire salt package to avoid not existing user issues\n- Support partly patched CVEs in CVE audit (bsc#1137229)\n\nspacewalk-setup:\n\n- Configure 150 Tomcat workers by default, matching httpds MaxClients\n\nspacewalk-utils:\n\n- Common-channels: Fix repo type assignment for type YUM\n- Adds support for Ubuntu and Debian channels to spacewalk-common-channels.\n\nspacewalk-web:\n\n- Fix the 'include recommended' button on channels selection in SSM (bsc#1145086)\n- Normalize date formats for actions, notifications and clm (bsc#1142774)\n- Add unsupported browser warning when using Internet Explorer\n\nsusemanager:\n\n- Dmidecode does not exist on s390x (bsc#1145119)\n\nsusemanager-docs_en:\n\n- Add link to the creation of the bootstrap script (bsc#1146895).\n- Improve adoc tagging.\n- LimitNOFILE back-port.\n- Fix command-line error (bsc#1096426).\n\nsusemanager-schema:\n\n- Improve performance for retrieving the user permissions on channels (bsc#1140644)\n\nsusemanager-sls:\n\n- Bootstrapping RES6/RHEL6/SLE11 with TLS1.2 now shows error message. (bsc#1147126)\n- Dmidecode does not exist on ppc64le and s390x (bsc#1145119)\n- Update susemanager.conf to use adler32 for computing the server_id for new minions\n\ntika-core:\n\nNew upstream version 1.2.2. Fixes security issues:\n\n- CVE-2019-10088: Fixed an OOM from a crafted Zip File in Apache Tika's RecursiveParserWrapper (bsc#1144500).\n- CVE-2019-10093: Fixed a Denial of Service in Apache Tika's 2003ml and 2006ml Parsers (bsc#1144510).\n- CVE-2019-10094: Fixed a stack overflow from crafted compressed files in Apache Tika's RecursiveParserWrapper (bsc#1144515).\n\n","status":"published","published":"2019-10-02T12:50:20Z","modified":"2026-02-04T04:30:58.027906Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2019:2930-1","title":"Security update for SUSE Manager Server 4.0","description":"\nThis update fixes the following issues:\n\ncobbler:\n\n- Fix for install loop caused autoinstallation profiles (bsc#1151875)\n- Update module config description to match new parameters\n- Add config migration script and runs it in post-install script\n- Fix for config backups in post install script (bsc#1149075)\n- Move apache config file cobbler.conf to conf.d directory\n  and remove the VirtualHost container as it overwrite rules\n  already set in conf.d\n- Realignment with Cobbler 3.0.0 release candidate.\n- Fix for typo in settings for scm_track module.\n- Optimization for settings loading in scm_track module.\n\ncpu-mitigations-formula:\n\n- Fix grub entry changed for sle12* so it matches sle15* (bsc#1145873)\n\nmgr-osad:\n\n- Obsolete all old python2-osa* packages to avoid conflicts (bsc#1152290)\n\npatterns-suse-manager:\n\n- Add recommends for cpu-mitigations-formula \n\npgjdbc-ng:\n\n- Allow dots in database name (bsc#1146416)\n\nprometheus-exporters-formula:\n\n- Allow to configure arbitrary arguments when running exporters\n- Add support for Debian/Ubuntu and Red Hat systems (RHEL/CentOS)\n- Install the LICENSE together with the package\n\npy26-compat-salt:\n\n- Get tornado dependency from the system on SLE12 (bsc#1149409) \n\npython-susemanager-retail:\n\n- Update to version 0.1.1568808472.be9f236\n- Parse parition type 82 as swap in SLEPOS migration (bsc#1136959)\n- Allow kernel command line for branches to be set as an option to\n  retail_branch_init CLI\n- Automatically calculate dhcp dynamic range from branch ip if not\n  set\n\npython-urlgrabber:\n\n- Allow non-integer values for URLGRABBER_DEBUG env variable (bsc#1152514)\n- Fixes usage of log level lookup for Python3 (bsc#1146683)\n\nspacecmd:\n\n- Java api expects content as encoded string instead of encode bytes like before (bsc#1153277)\n- Fix building and installing on CentOS8/RES8/RHEL8\n- Check that a channel doesn't have clones before deleting it (bsc#1138454)\n\nspacewalk-admin:\n\n- Avoid a 'Permission denied' salt error when publisher_acl\n  is set (bsc#1150154)\n\nspacewalk-backend:\n\n- Fix re-registration with re-activation key (bsc#1154275)\n- Change the default value of taskomatic maxmemory to 4GB\n- Add basic support for importing modular repositories\n- Import additional fields for Deb packages\n- Add script to update additional fields in the DB for existing Deb packages\n- Use active values for diskchecker mails\n- Parse restart_suggested flag from patches and set it as keywords (bsc#1151467)\n- Improve error message when deleting channel that's in a content lifecycle project (bsc#1145769)\n- Prevent 'reposync' crash when handling metadata on RPM repos (bsc#1138358)\n- Do not show expected WARNING messages from 'c_rehash'\n- Fix misspelling in spacewalk-repo-sync (bsc#1149633)\n- Remove credentials also from potential rhn.conf backup files in spacewalk-debug (bsc#1146419)\n- Do not crash 'rhn-satellite-exporter' with ModuleNotFound error (bsc#1146869)\n- Spacewalk-remove-channel check that channel doesn't have cloned channels before deleting it (bsc#1138454)\n- Fix broken spacewalk-data-fsck utility\n- Add '--latest' support for reposync on DEB based repositories\n- Do not try to download RPMs from the unresolved mirrorlist URL\n- Fix encoding issues with DB bytes values (bsc#1144300)\n- Fix import of rhnAuthPAM to avoid issues when using rhnpush.\n- Avoid traceback on mgr-inter-sync when there are problems\n  with cache of packages (bsc#1143016)\n\nspacewalk-branding:\n\n- Improve menu scrollbar style for firefox\n- Add UI message when salt-formulas system folders are unreachable (bsc#1142309)\n\nspacewalk-certs-tools:\n\n- Require mgr-daemon (new name of spacewalksd) so we systems with\n  spacewalksd get always the new package installed (bsc#1149353)\n\nspacewalk-client-tools:\n\n- Require mgr-daemon (new name of spacewalksd) so we systems with\n  spacewalksd get always the new package installed (bsc#1149353)\n- Enable spacewalk-update-service on package installation\n  (bsc#1143789)\n- Invalidate cache 5 minutes before actual expiration(bsc#1143562)\n\nspacewalk-config:\n\n- Change the default value of taskomatic maxmemory to 4GB\n- Resolve modules.yaml file for modular repositories\n\nspacewalk-java:\n\n- Change the default value of taskomatic maxmemory to 4GB\n- Silence cache strategy Hibernate warning\n- Return result in compatible type to what defined in database procedure (bsc#1150729)\n- Allow channels names to start with numbers\n- Fix: handle special deb package names (bsc#1150113)\n- Remove extra spaces in dependencies fields in Debian repo Packages file (bsc#1145551)\n- Allow monitoring for managed systems running Ubuntu 18.04 and RedHat 6/7\n- Improve performance for 'Manage Software Channels' view (bsc#1151399)\n- Import additional fields for Deb packages\n- Use value from systemd unit file if not set in /etc/rhn/rhn.conf\n- Implement 'keyword' filter for Content Lifecycle Management\n- Add support for Azure, Amazon EC2, and Google Compute Engine as Virtual Host Manager.\n- Allow ssl connections from Tomcat to Postgres (bsc#1149210)\n- Use default in case taskomatic.java.maxmemory is unset\n- Fix parsing of /etc/rhn/rhn.conf for taskomatic.java.maxmemory (bsc#1151097)\n- Change form order and change project creation message (bsc#1145744)\n- Use 'SCC organization credentials' instead of 'SCC credentials' in error message (bsc#1149425)\n- Implement 'regular expression' Filter for Content Lifecycle Management\n  matching package names, patch name, patch synopsis and package names in patches\n- Implement provisioning for salt clients\n- Explicitly mention in API docs that to preserve LF/CR, user needs to encode the data(bsc#1135442)\n- New Single Page Application engine for the UI. It can be enabled with the config 'web.spa.enable' set to true\n- Check that a channel doesn't have clones before deleting it (bsc#1138454)\n- Fix documentation of contentmanagement handler (bsc#1145753)\n- Add new API endpoint to list available Filter Criteria\n- Improve API documentation of Filter Criteria\n- Implement 'patch contains package' Filter for Content Lifecycle Management\n- Implement Filter Patch 'by type' Content Lifecycle Management\n- Improve websocket authentication to prevent errors in logs (bsc#1138454)\n- Implement filtering errata by synopsis in Content Lifecycle Management\n- Normalize date formats for actions, notifications and clm (bsc#1142774)\n- Implement ALLOW filters in Content Lifecycle Management\n- Implement 'by date' Filter for Content Lifecycle Management\n- UI render without error if salt-formulas system folders are unreachable (bsc#1142309)\n- Cloning Errata from a specific channel should not take packages\n  from other channels (bsc#1142764)\n- Add susemanager as prerequired for spacewalk-java\n\nspacewalk-setup:\n\n- Fix cobbler authentication module configuration required for\n  new cobbler package\n- Configure 150 Tomcat workers by default, matching httpds MaxClients\n\nspacewalk-utils:\n\n- Add FQDN resolver for spacewalk-manage-channel-lifecycle (bsc#1153578)\n- Common-channels: Fix repo type assignment for type YUM\n\nspacewalk-web:\n\n- Redirect to project when canceling creating a filter (bsc#1145750)\n- Better visualization of the filters attached to a CLM Project. Allow/deny are now split\n- Fix ui issues with content lifecycle project list page (bsc#1145587)\n- Implement 'keyword' filter for Content Lifecycle Management\n- Enable Azure, Amazon EC2 and Google Compute Engine as available Virtual host Managers\n- Trim strings when creating/updating image stores/profiles (bsc#1133429)\n- Show loading spin while loading salt keys data (bsc#1150180)\n- CLM - Disable clones by default of the shown CLM Project sources\n- Change form order and change project creation message (bsc#1145744)\n- Add UI message when salt-formulas system folders are unreachable (bsc#1142309)\n- Implement 'regular expression' Filter for Content Lifecycle Management\n  matching package names, patch name, patch synopsis and package names in patches\n- New Single Page Application engine for the UI. It can be enabled with the config 'web.spa.enable' set to true\n- Add environment label when deleting environment (bsc#1145758)\n- Change color of disabled build button on clp page (bsc#1145626)\n- Fix the 'include recommended' button on channels selection in SSM (bsc#1145086)\n- Implement 'patch contains package' Filter for Content Lifecycle Management\n- Implement Filter Patch 'by type' Content Lifecycle Management\n- Implement filtering errata by synopsis in Content Lifecycle Management\n- Normalize date formats for actions, notifications and clm (bsc#1142774)\n- Implement ALLOW filters in Content Lifecycle Management\n- Implement 'by date' Filter for Content Lifecycle Management\n\nsusemanager:\n\n- Require dmidecode only for SLE12 aarch64 and x86_64 (bsc#1152170)\n- Require pmtools only for SLE11 i586 and x86_64 (bsc#1150314)\n- Fix test for btrfs subvolume for new btrfs version (bsc#1151666)\n- Ensure working directory is /root during setup (bsc#1148169)\n- Dmidecode does not exist on s390x (bsc#1145119)\n\nsusemanager-docs_en:\n\n- Update text and images (mu-4.0.3); many changes caused by Technical and Content Reviews.\n- Added partition permissions to Install Guide (bsc#1152735)\n- Move Disconnected Setup from Client Config to Admin Guide\n- Updated references to documentation.suse.com (was: www.suse.com/documentation)\n- Increase default value for taskomatic to 4GB\n- Registering to proxy information in Install Guide\n- Edits to Prometheus section in Admin Guide\n- Update database migration section in Upgrade Guide\n- Update server update, upgrade, and migration chapters in Upgrade Guide\n- Update server installation and setup chapters\n- Update proxy installation and setup chapters\n- Add section about maintenance window in Admin Guide\n- Update Kubernetes chapter\n- Admin Guide: ISS: Adapt the CA path to correspond to SLES 15.1\n- Update image management\n- Update channel management screenshot in Reference\n- Update CLM\n- Provide basic documentation on foreign clients\n- Update info on mgr-sync\n- New images added to Retail Guide\n- Minor edits in Salt Guide\n- Improvements to Troubleshooting section in Admin Guide\n- Removed reference to SLP in Install Guide\n- Minor edits to SSM in Client Config Guide\n\nsusemanager-schema:\n\n- Fix in schema migration script when recreating the 'suseUserRoleView' (bsc#1151280)\n- Fix: handle special deb package names (bsc#1150113)\n- Refactor in suseChannelUserRoleView for retrieving the parent_channel_id (bsc#1151399)\n- Add tables rhnPackageExtraTag and rhnPackageExtraTagKey\n- Allow monitoring for Ubuntu systems\n- Add new types needed for Azure, Amazon EC2 and Google CE\n- Enable provisioning for salt clients\n- Allow package changelog entries with more than 3000 characters (bsc#1144889)\n\nsusemanager-sls:\n\n- Require pmtools only for SLE11 i586 and x86_64 (bsc#1150314)\n- Introduce dnf-susemanager-plugin for RHEL8 minions\n- Provide custom grain to report 'instance id' when running on Public Cloud instances\n- Disable legacy startup events for new minions\n- Implement provisioning for salt clients\n- Dmidecode does not exist on ppc64le and s390x (bsc#1145119)\n- Update susemanager.conf to use adler32 for computing the server_id for new minions\n- Do not show errors when polling internal metadata API (bsc#1155794)\n- Add missing 'public_cloud' custom grain (bsc#1155656)\n\nsusemanager-sync-data:\n\n- Ubuntu repositories released\n\ntika-core:\n\n- New upstream version 1.2.2. Fixes:\n  * OOM from a crafted Zip File in Apache Tika's \n    RecursiveParserWrapper (CVE-2019-10088) (bsc#1144500).\n  * Denial of Service in Apache Tika's 2003ml and 2006ml \n    Parsers (CVE-2019-10093) (bsc#1144510).\n  * StackOverflow from Crafted Package/Compressed Files in Apache \n    Tika's RecursiveParserWrapper (CVE-2019-10094) (bsc#1144515). \n\nvirtual-host-gatherer:\n\n- Add new modules to deal with Amazon EC2, Azure and Google Compute\n\n","status":"published","published":"2019-11-07T16:52:47Z","modified":"2026-02-04T03:13:50.05276Z","updated_at":"2026-11-02T15:53:47.06185Z"}]}}