Apache Tika Denial of Service due to Infinite Loop in Tika's SQLite3Parser

MEDIUM 6.5CVE-2018-17197 · GHSA-3448-vfvv-xp9g · Published 24/12/2018 · updated 17/06/2026

In short

CVE-2018-17197 is a MEDIUM (CVSS 6.5) vulnerability affecting org.apache.tika:tika-parsers, tika (apache).
Chance of exploitation in the next 30 days (EPSS): 6.1%, higher than 93.5% of all vulnerabilities.
Fix: update to 1.20 or later.

Package	Affected versions	Patched versions
org.apache.tika:tika-parsers Maven	`≥ 1.8, < 1.20`	`1.20`
tika apache	`≥ 1.8, ≤ 1.19.1`	No fix yet

A carefully crafted or corrupt sqlite file can cause an infinite loop in Apache Tika's SQLite3Parser in versions 1.8-1.19.1 of Apache Tika.

NVD description

A carefully crafted or corrupt sqlite file can cause an infinite loop in Apache Tika's SQLite3Parser in versions 1.8-1.19.1 of Apache Tika.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.