Moderate severity vulnerability that affects org.apache.tika:tika-core

MEDIUM 5.5CVE-2018-1338 · GHSA-5mf7-26mw-3rqr · Published 25/04/2018 · updated 17/06/2026

In short

CVE-2018-1338 is a MEDIUM (CVSS 5.5) vulnerability affecting org.apache.tika:tika-core, tika (apache).
Chance of exploitation in the next 30 days (EPSS): 1.9%, higher than 79.9% of all vulnerabilities.
Fix: update to 1.18 or later.

Package	Affected versions	Patched versions
org.apache.tika:tika-core Maven	`< 1.18`	`1.18`
tika apache	`< 1.18`	`1.18`

A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's BPGParser in versions of Apache Tika before 1.18.

NVD description

A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's BPGParser in versions of Apache Tika before 1.18.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

Maven

< 1.18

1.18

< 1.18

1.18

More vulnerabilities in org.apache.tika:tika-core

See all →