{ "@id": "urn:uuid:71ca5fd0-327b-46c0-8378-b6dad4be1b66", "role": "Document Creator", "author": "https://tuxcare.com", "version": 17, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T15:06:44.318506+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-6612 does not affect version 2.9.4-tuxcare.7 of org.apache.tika:tika-core. Version 2.9.4 is not affected by CVE-2012-6612: the security fix is already present in the target branch. Momus prerequisite check: \"All 7 patch commits already exist in target branch\". No backport needed.", "vulnerability": { "name": "CVE-2012-6612" }, "impact_statement": "Version 2.9.4 is not affected by CVE-2012-6612: the security fix is already present in the target branch. Momus prerequisite check: \"All 7 patch commits already exist in target branch\". No backport needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2013-6407 does not affect version 2.9.4-tuxcare.7 of org.apache.tika:tika-core. Version 2.9.4 is not affected by CVE-2013-6407: the security fix is already present in the target branch. Momus prerequisite check: \"All 4 patch commits already exist in target branch\". No backport needed.", "vulnerability": { "name": "CVE-2013-6407" }, "impact_statement": "Version 2.9.4 is not affected by CVE-2013-6407: the security fix is already present in the target branch. Momus prerequisite check: \"All 4 patch commits already exist in target branch\". No backport needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-3415 is a false positive for org.apache.tika:tika-core 2.9.4-tuxcare.7. CVE-2015-3415 is a defect in the SQLite C library: sqlite3VdbeExec in src/vdbe.c mishandles the MEM_Dyn flag on registers when comparison operators revert an affinity change, so a crafted CHECK clause such as CHECK(0&O>O) in a CREATE TABLE statement can cause an invalid free. The SQLite project fixed it in its own repository, in check-in 02e3c88fbf6abdcf3975fb0fb71972b0ab30da30 to src/vdbe.c, released in SQLite 3.8.9, and NVD records the flaw against SQLite.\n\nApache Tika is a Java library and contains no SQLite engine code; no SQLite C sources have ever existed anywhere in its history. Its SQLite support is a JDBC client only - SQLite3Parser, SQLite3DBParser and SQLite3TableReader in tika-parser-sqlite3-module - which can reach an engine only through the declared org.xerial:sqlite-jdbc dependency.\n\nThe vulnerability is therefore in SQLite, not in Apache Tika, in any version.", "vulnerability": { "name": "CVE-2015-3415" }, "impact_statement": "CVE-2015-3415 is a defect in the SQLite C library: sqlite3VdbeExec in src/vdbe.c mishandles the MEM_Dyn flag on registers when comparison operators revert an affinity change, so a crafted CHECK clause such as CHECK(0&O>O) in a CREATE TABLE statement can cause an invalid free. The SQLite project fixed it in its own repository, in check-in 02e3c88fbf6abdcf3975fb0fb71972b0ab30da30 to src/vdbe.c, released in SQLite 3.8.9, and NVD records the flaw against SQLite.\n\nApache Tika is a Java library and contains no SQLite engine code; no SQLite C sources have ever existed anywhere in its history. Its SQLite support is a JDBC client only - SQLite3Parser, SQLite3DBParser and SQLite3TableReader in tika-parser-sqlite3-module - which can reach an engine only through the declared org.xerial:sqlite-jdbc dependency.\n\nThe vulnerability is therefore in SQLite, not in Apache Tika, in any version." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-3416 is a false positive for org.apache.tika:tika-core 2.9.4-tuxcare.7. CVE-2015-3416 is a defect in the SQLite database engine itself: sqlite3VXPrintf in printf.c mishandles precision and width values during floating-point conversions, so a crafted printf call inside a SELECT statement can trigger an integer overflow and a stack-based buffer overflow. NVD records the affected products as SQLite before 3.8.9 and the PHP builds that embed it. The fix was made by the SQLite project and released in SQLite 3.8.9.\n\nApache Tika contains no part of the SQLite engine. Its SQLite support is Java only: the tika-parser-sqlite3-module classes SQLite3Parser, SQLite3DBParser and SQLite3TableReader reach SQLite through the JDBC API (org.sqlite.JDBC, org.sqlite.SQLiteConfig), and the engine is supplied by the separate org.xerial sqlite-jdbc artifact. No release of Tika has ever carried printf.c or any other SQLite source.\n\nThe vulnerability therefore does not apply to this library.", "vulnerability": { "name": "CVE-2015-3416" }, "impact_statement": "CVE-2015-3416 is a defect in the SQLite database engine itself: sqlite3VXPrintf in printf.c mishandles precision and width values during floating-point conversions, so a crafted printf call inside a SELECT statement can trigger an integer overflow and a stack-based buffer overflow. NVD records the affected products as SQLite before 3.8.9 and the PHP builds that embed it. The fix was made by the SQLite project and released in SQLite 3.8.9.\n\nApache Tika contains no part of the SQLite engine. Its SQLite support is Java only: the tika-parser-sqlite3-module classes SQLite3Parser, SQLite3DBParser and SQLite3TableReader reach SQLite through the JDBC API (org.sqlite.JDBC, org.sqlite.SQLiteConfig), and the engine is supplied by the separate org.xerial sqlite-jdbc artifact. No release of Tika has ever carried printf.c or any other SQLite source.\n\nThe vulnerability therefore does not apply to this library." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-3717 is a false positive for org.apache.tika:tika-core 2.9.4-tuxcare.7. vulnerabilikity is in SQLite, not tika", "vulnerability": { "name": "CVE-2015-3717" }, "impact_statement": "vulnerabilikity is in SQLite, not tika" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-5895 is a false positive for org.apache.tika:tika-core 2.9.4-tuxcare.7. CVE-2015-5895 covers unspecified vulnerabilities in the SQLite C library before 3.8.10.2, as shipped in Apple iOS before 9. NVD records it against SQLite and Apple iOS only, with the CPEs cpe:2.3:a:sqlite:sqlite and cpe:2.3:o:apple:iphone_os, and every reference points to Apple's iOS 9 security advisory of September 2015. There is no Apache Tika CPE.\n\nApache Tika contains no SQLite engine code in any version. Its SQLite support is a JDBC client: in tika-parser-sqlite3-module, SQLite3Parser, SQLite3DBParser and SQLite3TableReader load the org.sqlite.JDBC driver and read tables through java.sql. The tree holds no C sources, no SQLite amalgamation, and no vendored or shaded copy of the engine; the engine can reach an application only through the org.xerial:sqlite-jdbc dependency.\n\nThe vulnerability therefore does not apply to this library.", "vulnerability": { "name": "CVE-2015-5895" }, "impact_statement": "CVE-2015-5895 covers unspecified vulnerabilities in the SQLite C library before 3.8.10.2, as shipped in Apple iOS before 9. NVD records it against SQLite and Apple iOS only, with the CPEs cpe:2.3:a:sqlite:sqlite and cpe:2.3:o:apple:iphone_os, and every reference points to Apple's iOS 9 security advisory of September 2015. There is no Apache Tika CPE.\n\nApache Tika contains no SQLite engine code in any version. Its SQLite support is a JDBC client: in tika-parser-sqlite3-module, SQLite3Parser, SQLite3DBParser and SQLite3TableReader load the org.sqlite.JDBC driver and read tables through java.sql. The tree holds no C sources, no SQLite amalgamation, and no vendored or shaded copy of the engine; the engine can reach an application only through the org.xerial:sqlite-jdbc dependency.\n\nThe vulnerability therefore does not apply to this library." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7" } } ], "timestamp": "2026-11-04T09:04:11.456857+00:00", "status_notes": "Vulnerability CVE-2016-4434 does not affect version 2.9.4-tuxcare.7 of org.apache.tika:tika-core. Apache Tika 2.9.4-tuxcare.10 is NOT affected by CVE-2016-4434 (XXE in OOXML/XMP parsing). The vulnerability was fixed in upstream Apache Tika 1.13 (April 2016) by implementing comprehensive XXE defenses in XMLReaderUtils, including entity resolvers that block all external entity resolution, secure parser configurations, and entity expansion limits. The target is running Tika 2.9.4 (released 2024), which inherited all XXE protections from the upstream release. All affected parsers (PDF XFA, XMP metadata, OOXML) use the secure XML parsing utilities. The fix was authored by tallison@mitre.org (upstream Apache Tika developer), not TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.13), NVD (= 1.12), Snyk (>= 1.6, < 1.13).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-4434" }, "impact_statement": "Apache Tika 2.9.4-tuxcare.10 is NOT affected by CVE-2016-4434 (XXE in OOXML/XMP parsing). The vulnerability was fixed in upstream Apache Tika 1.13 (April 2016) by implementing comprehensive XXE defenses in XMLReaderUtils, including entity resolvers that block all external entity resolution, secure parser configurations, and entity expansion limits. The target is running Tika 2.9.4 (released 2024), which inherited all XXE protections from the upstream release. All affected parsers (PDF XFA, XMP metadata, OOXML) use the secure XML parsing utilities. The fix was authored by tallison@mitre.org (upstream Apache Tika developer), not TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.13), NVD (= 1.12), Snyk (>= 1.6, < 1.13)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7" } } ], "timestamp": "2026-11-04T09:04:11.456857+00:00", "status_notes": "Vulnerability CVE-2016-6809 does not affect version 2.9.4-tuxcare.7 of org.apache.tika:tika-core. CVE-2016-6809 is NOT present in Apache Tika 2.9.4-tuxcare.10. The vulnerability allowed Java code execution via deserialized objects in MATLAB files. The target code contains the upstream vendor's fix (MatFileReader.setAllowObjectDeserialization(false) in a static initializer block), which was already present in the Apache Tika 2.9.4 upstream release before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.14), NVD (<= 1.13), Snyk (>= 1.6, < 1.14).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-6809" }, "impact_statement": "CVE-2016-6809 is NOT present in Apache Tika 2.9.4-tuxcare.10. The vulnerability allowed Java code execution via deserialized objects in MATLAB files. The target code contains the upstream vendor's fix (MatFileReader.setAllowObjectDeserialization(false) in a static initializer block), which was already present in the Apache Tika 2.9.4 upstream release before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.14), NVD (<= 1.13), Snyk (>= 1.6, < 1.14)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7" } } ], "timestamp": "2026-11-04T09:02:00.202619+00:00", "status_notes": "Vulnerability CVE-2018-11761 does not affect version 2.9.4-tuxcare.7 of org.apache.tika:tika-core. CVE-2018-11761 affects Apache Tika 0.1-1.18 (unlimited XML entity expansion leading to DoS). The target (Apache Tika 2.9.4) contains comprehensive defenses implemented in upstream commit 4e67928412ad (2018-09-06) by tallison@apache.org, which shipped in Tika 1.19. The fix includes: (1) setExpandEntityReferences(false) disabling entity expansion entirely; (2) DEFAULT_MAX_ENTITY_EXPANSIONS=20 hard limit; (3) trySetXercesSecurityManager() enforcing limits on SAX/DOM parsers; (4) trySetStaxSecurityManager() for StAX parsers; (5) SAX features disabling external entities. The fix was IN_UPSTREAM_RELEASE before TuxCare onboarded 2.9.4 (first TuxCare commit c6436802a, 2026-01-19). Verdict: not_affected (upstream fix already present; vulnerable pattern absent).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 0.1, < 1.19.1), NVD (>= 0.1, <= 1.18), cve.org (>= 0.1, <= 1.18), Snyk (>= 1.0, < 1.19; >= 1.0, < 1.19).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11761" }, "impact_statement": "CVE-2018-11761 affects Apache Tika 0.1-1.18 (unlimited XML entity expansion leading to DoS). The target (Apache Tika 2.9.4) contains comprehensive defenses implemented in upstream commit 4e67928412ad (2018-09-06) by tallison@apache.org, which shipped in Tika 1.19. The fix includes: (1) setExpandEntityReferences(false) disabling entity expansion entirely; (2) DEFAULT_MAX_ENTITY_EXPANSIONS=20 hard limit; (3) trySetXercesSecurityManager() enforcing limits on SAX/DOM parsers; (4) trySetStaxSecurityManager() for StAX parsers; (5) SAX features disabling external entities. The fix was IN_UPSTREAM_RELEASE before TuxCare onboarded 2.9.4 (first TuxCare commit c6436802a, 2026-01-19). Verdict: not_affected (upstream fix already present; vulnerable pattern absent).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 0.1, < 1.19.1), NVD (>= 0.1, <= 1.18), cve.org (>= 0.1, <= 1.18), Snyk (>= 1.0, < 1.19; >= 1.0, < 1.19)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7" } } ], "timestamp": "2026-11-02T19:45:30.423999+00:00", "status_notes": "Vulnerability CVE-2018-11762 does not affect version 2.9.4-tuxcare.7 of org.apache.tika:tika-core. not_affected \u2014 CVE-2018-11762 (path traversal via absolute paths in embedded filenames) is NOT present in Apache Tika 2.9.4-tuxcare.10. The vulnerability affected Tika 0.9-1.18 where embedded files with absolute paths (e.g., \"C:/evil.bat\") would overwrite files at those absolute locations. The fix (TIKA-2687, commit c0fb57d9d) was applied by upstream Apache developer tallison@apache.org on July 13, 2018, and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11762" }, "impact_statement": "not_affected \u2014 CVE-2018-11762 (path traversal via absolute paths in embedded filenames) is NOT present in Apache Tika 2.9.4-tuxcare.10. The vulnerability affected Tika 0.9-1.18 where embedded files with absolute paths (e.g., \"C:/evil.bat\") would overwrite files at those absolute locations. The fix (TIKA-2687, commit c0fb57d9d) was applied by upstream Apache developer tallison@apache.org on July 13, 2018, and ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7" } } ], "timestamp": "2026-11-04T09:02:00.202619+00:00", "status_notes": "Vulnerability CVE-2018-11796 does not affect version 2.9.4-tuxcare.7 of org.apache.tika:tika-core. The target Apache Tika 2.9.4-tuxcare.10 is NOT vulnerable to CVE-2018-11796. The fix for this vulnerability was applied by Apache Tika upstream in version 1.19.1 (September 2018) via commit 86d4ba1e1 (TIKA-2727) and was already present in the 2.9.4 release that TuxCare onboarded. The Xerces2PoolSAXParser class correctly preserves the SecurityManager across parser reset() calls, preventing entity expansion limits from being removed after the first parse.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 0.1, < 1.19.1), NVD (>= 0.1, <= 1.19), cve.org (>= 0.1, <= 1.19), Snyk (>= 0.4, < 1.19.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11796" }, "impact_statement": "The target Apache Tika 2.9.4-tuxcare.10 is NOT vulnerable to CVE-2018-11796. The fix for this vulnerability was applied by Apache Tika upstream in version 1.19.1 (September 2018) via commit 86d4ba1e1 (TIKA-2727) and was already present in the 2.9.4 release that TuxCare onboarded. The Xerces2PoolSAXParser class correctly preserves the SecurityManager across parser reset() calls, preventing entity expansion limits from being removed after the first parse.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 0.1, < 1.19.1), NVD (>= 0.1, <= 1.19), cve.org (>= 0.1, <= 1.19), Snyk (>= 0.4, < 1.19.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7" } } ], "timestamp": "2026-11-04T09:03:00.104314+00:00", "status_notes": "Vulnerability CVE-2018-1335 does not affect version 2.9.4-tuxcare.7 of org.apache.tika:tika-core. CVE-2018-1335 (command injection via HTTP headers) is NOT present in Apache Tika 2.9.4. The vulnerability affected Tika versions 1.7-1.17 and was fixed by upstream Apache in version 1.18 (April 2018). The target version 2.9.4 includes all security fixes from 1.18+, including: (1) ALLOWABLE_HEADER_CHARS pattern validation for header values, (2) checkTrustWorthy() method preventing calls to \"trusted\" setters, (3) safe command construction using CommandLine.addArguments(args, true) instead of string concatenation. The fix commit (af06e87f) by upstream author tallison@mitre.org was already present in the Apache Tika 2.9.4 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.7, < 1.18), NVD (< 1.18), cve.org (>= 1.7, <= 1.17), Snyk (< 1.18; < 1.18).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1335" }, "impact_statement": "CVE-2018-1335 (command injection via HTTP headers) is NOT present in Apache Tika 2.9.4. The vulnerability affected Tika versions 1.7-1.17 and was fixed by upstream Apache in version 1.18 (April 2018). The target version 2.9.4 includes all security fixes from 1.18+, including: (1) ALLOWABLE_HEADER_CHARS pattern validation for header values, (2) checkTrustWorthy() method preventing calls to \"trusted\" setters, (3) safe command construction using CommandLine.addArguments(args, true) instead of string concatenation. The fix commit (af06e87f) by upstream author tallison@mitre.org was already present in the Apache Tika 2.9.4 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.7, < 1.18), NVD (< 1.18), cve.org (>= 1.7, <= 1.17), Snyk (< 1.18; < 1.18)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7" } } ], "timestamp": "2026-11-02T19:46:11.344168+00:00", "status_notes": "Vulnerability CVE-2018-1338 does not affect version 2.9.4-tuxcare.7 of org.apache.tika:tika-core. not_affected \u2014 CVE-2018-1338 is NOT present in Apache Tika 2.9.4-tuxcare.10. The vulnerability (infinite loop in BPGParser via readUE7 method) was fixed in upstream Apache Tika 1.18 (April 2018) by adding a buffer underrun check. This fix was already present in the upstream Apache Tika 2.9.4 release that TuxCare onboarded. The vulnerable code pattern does not exist in the target version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1338" }, "impact_statement": "not_affected \u2014 CVE-2018-1338 is NOT present in Apache Tika 2.9.4-tuxcare.10. The vulnerability (infinite loop in BPGParser via readUE7 method) was fixed in upstream Apache Tika 1.18 (April 2018) by adding a buffer underrun check. This fix was already present in the upstream Apache Tika 2.9.4 release that TuxCare onboarded. The vulnerable code pattern does not exist in the target version." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2018-20346 is a false positive for org.apache.tika:tika-core 2.9.4-tuxcare.7. CVE-2018-20346 is a flaw in SQLite itself: with the FTS3 extension enabled, an integer overflow and resultant buffer overflow occur on FTS3 queries issued after crafted changes to FTS3 shadow tables, fixed in SQLite 3.25.3. NVD and OSV record it against SQLite, Google Chrome and operating-system distributions; neither lists Apache Tika or any Java package.\n\nApache Tika contains no implementation of SQLite in any version. The tree holds no C sources, no native libraries and no vendored or shaded copy of the SQLite engine. Its only relationship to SQLite is a Maven dependency on org.xerial:sqlite-jdbc, used by tika-parser-sqlite3-module, whose SQLite3DBParser imports org.sqlite.SQLiteConfig and opens a JDBC connection through the driver. The overflowing code is the driver's bundled native SQLite library, not this library's code.\n\nThe vulnerability therefore does not apply to Apache Tika.", "vulnerability": { "name": "CVE-2018-20346" }, "impact_statement": "CVE-2018-20346 is a flaw in SQLite itself: with the FTS3 extension enabled, an integer overflow and resultant buffer overflow occur on FTS3 queries issued after crafted changes to FTS3 shadow tables, fixed in SQLite 3.25.3. NVD and OSV record it against SQLite, Google Chrome and operating-system distributions; neither lists Apache Tika or any Java package.\n\nApache Tika contains no implementation of SQLite in any version. The tree holds no C sources, no native libraries and no vendored or shaded copy of the SQLite engine. Its only relationship to SQLite is a Maven dependency on org.xerial:sqlite-jdbc, used by tika-parser-sqlite3-module, whose SQLite3DBParser imports org.sqlite.SQLiteConfig and opens a JDBC connection through the driver. The overflowing code is the driver's bundled native SQLite library, not this library's code.\n\nThe vulnerability therefore does not apply to Apache Tika." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2018-20505 is a false positive for org.apache.tika:tika-core 2.9.4-tuxcare.7. CVE-2018-20505 is a flaw in the SQLite C library. The upstream fix, check-in c6e519f3 for ticket 1a84668dcfdebaf12415d, released in SQLite 3.25.3, corrects an assertion in the query planner (src/wherecode.c, removeUnindexableInClauseTerms) reached by row-value operations against a PRIMARY KEY containing duplicate columns. NVD records the affected products as SQLite up to 3.25.2 and several Apple operating systems and applications; no Java package is listed.\n\nApache Tika contains no SQLite implementation. The tree holds no C or native sources and no vendored, shaded or repackaged SQLite code; tika-parser-sqlite3-module reads .sqlite files only through the third-party org.xerial:sqlite-jdbc driver, declared as an ordinary dependency.\n\nThe vulnerable code is therefore never Apache Tika's own code, in this or any version.", "vulnerability": { "name": "CVE-2018-20505" }, "impact_statement": "CVE-2018-20505 is a flaw in the SQLite C library. The upstream fix, check-in c6e519f3 for ticket 1a84668dcfdebaf12415d, released in SQLite 3.25.3, corrects an assertion in the query planner (src/wherecode.c, removeUnindexableInClauseTerms) reached by row-value operations against a PRIMARY KEY containing duplicate columns. NVD records the affected products as SQLite up to 3.25.2 and several Apple operating systems and applications; no Java package is listed.\n\nApache Tika contains no SQLite implementation. The tree holds no C or native sources and no vendored, shaded or repackaged SQLite code; tika-parser-sqlite3-module reads .sqlite files only through the third-party org.xerial:sqlite-jdbc driver, declared as an ordinary dependency.\n\nThe vulnerable code is therefore never Apache Tika's own code, in this or any version." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2018-20506 is a false positive for org.apache.tika:tika-core 2.9.4-tuxcare.7. \u0421VE in SQLite, not in tika", "vulnerability": { "name": "CVE-2018-20506" }, "impact_statement": "\u0421VE in SQLite, not in tika" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7" } } ], "timestamp": "2026-11-02T19:42:57.810622+00:00", "status_notes": "Vulnerability CVE-2018-8017 does not affect version 2.9.4-tuxcare.7 of org.apache.tika:tika-core. not_affected \u2014 CVE-2018-8017 is not present in Apache Tika 2.9.4-tuxcare.10. The vulnerability, which allowed infinite loops in IptcAnpaParser due to off-by-one boundary checks, was fixed in the upstream Apache Tika release. All 6 instances where the vulnerable pattern `if (read > value.length)` existed have been corrected to `if (read >= value.length)` in the target. The fix was authored by tallison@mitre.or...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-8017" }, "impact_statement": "not_affected \u2014 CVE-2018-8017 is not present in Apache Tika 2.9.4-tuxcare.10. The vulnerability, which allowed infinite loops in IptcAnpaParser due to off-by-one boundary checks, was fixed in the upstream Apache Tika release. All 6 instances where the vulnerable pattern `if (read > value.length)` existed have been corrected to `if (read >= value.length)` in the target. The fix was authored by tallison@mitre.or..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2018-8740 is a false positive for org.apache.tika:tika-core 2.9.4-tuxcare.7. CVE-2018-8740 is a defect in the SQLite database engine itself: in SQLite through 3.22.0, a schema corrupted with a CREATE TABLE AS statement causes a NULL pointer dereference in src/build.c and src/prepare.c. NVD records the affected product as SQLite up to 3.22.0, and every reference points to the SQLite project's own timeline and patch.\n\nApache Tika contains no SQLite code. The Tika codebase has never held SQLite's C sources or a compiled SQLite library in any version; LICENSE.txt notes only that SQLite is bundled inside org.xerial's sqlite-jdbc. Tika's own SQLite support is Java only: SQLite3Parser and SQLite3DBParser drive that driver over JDBC.\n\nThe vulnerable code is therefore never Tika's, in any version, and the flaw applies to the SQLite engine shipped by that third-party driver rather than to this library.", "vulnerability": { "name": "CVE-2018-8740" }, "impact_statement": "CVE-2018-8740 is a defect in the SQLite database engine itself: in SQLite through 3.22.0, a schema corrupted with a CREATE TABLE AS statement causes a NULL pointer dereference in src/build.c and src/prepare.c. NVD records the affected product as SQLite up to 3.22.0, and every reference points to the SQLite project's own timeline and patch.\n\nApache Tika contains no SQLite code. The Tika codebase has never held SQLite's C sources or a compiled SQLite library in any version; LICENSE.txt notes only that SQLite is bundled inside org.xerial's sqlite-jdbc. Tika's own SQLite support is Java only: SQLite3Parser and SQLite3DBParser drive that driver over JDBC.\n\nThe vulnerable code is therefore never Tika's, in any version, and the flaw applies to the SQLite engine shipped by that third-party driver rather than to this library." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7" } } ], "timestamp": "2026-11-04T09:03:00.104314+00:00", "status_notes": "Vulnerability CVE-2019-10088 does not affect version 2.9.4-tuxcare.7 of org.apache.tika:tika-core. Apache Tika 2.9.4 is NOT AFFECTED by CVE-2019-10088. The vulnerability affected versions 1.7-1.21 and was fixed in version 1.22 (July 2019) by upstream Apache developers. The target version 2.9.4 already contains both required fixes: (1) RecursivelySecureContentHandler for zip bomb detection via SecureContentHandler wrapping, and (2) MAX_DEPTH=100 limit to prevent unbounded recursion depth. These fixes were present in the upstream Apache Tika 2.9.4 release that TuxCare onboarded, not added by TuxCare backports.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.7, < 1.22), NVD (>= 1.7, <= 1.21), cve.org (>= 1.7, <= 1.21), Snyk (>= 1.7, < 1.22).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10088" }, "impact_statement": "Apache Tika 2.9.4 is NOT AFFECTED by CVE-2019-10088. The vulnerability affected versions 1.7-1.21 and was fixed in version 1.22 (July 2019) by upstream Apache developers. The target version 2.9.4 already contains both required fixes: (1) RecursivelySecureContentHandler for zip bomb detection via SecureContentHandler wrapping, and (2) MAX_DEPTH=100 limit to prevent unbounded recursion depth. These fixes were present in the upstream Apache Tika 2.9.4 release that TuxCare onboarded, not added by TuxCare backports.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.7, < 1.22), NVD (>= 1.7, <= 1.21), cve.org (>= 1.7, <= 1.21), Snyk (>= 1.7, < 1.22)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7" } } ], "timestamp": "2026-11-04T09:03:00.104314+00:00", "status_notes": "Vulnerability CVE-2019-10094 does not affect version 2.9.4-tuxcare.7 of org.apache.tika:tika-core. CVE-2019-10094 affects Apache Tika versions 1.7-1.21. The target version 2.9.4 is not affected because the fix (MAX_DEPTH limiting to prevent stack overflow from quine files) was introduced in upstream version 1.22 (commit 1158d893dc952c573f7a12c7e4855cdce479fc2a, July 2019) and is present in the 2.9.4 upstream release that TuxCare onboarded. The vulnerable pattern (unbounded recursive parsing depth) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.7, < 1.22), NVD (>= 1.7, <= 1.21), cve.org (>= 1.7, <= 1.21), Snyk (>= 1.7, < 1.22).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10094" }, "impact_statement": "CVE-2019-10094 affects Apache Tika versions 1.7-1.21. The target version 2.9.4 is not affected because the fix (MAX_DEPTH limiting to prevent stack overflow from quine files) was introduced in upstream version 1.22 (commit 1158d893dc952c573f7a12c7e4855cdce479fc2a, July 2019) and is present in the 2.9.4 upstream release that TuxCare onboarded. The vulnerable pattern (unbounded recursive parsing depth) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.7, < 1.22), NVD (>= 1.7, <= 1.21), cve.org (>= 1.7, <= 1.21), Snyk (>= 1.7, < 1.22)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2019-19645 does not affect version 2.9.4-tuxcare.7 of org.apache.tika:tika-core. not_affected \u2014 Target Apache Tika 2.9.4-tuxcare.9 uses SQLite version 3.49.1.0 via org.xerial:sqlite-jdbc dependency. CVE-2019-19645 affects SQLite through version 3.30.1 (infinite recursion in alter.c when processing ALTER TABLE statements on self-referential views). Since 3.49.1.0 >> 3.30.1, the vulnerable code pattern is not present. The fix was applied by upstream SQLite project and inherited through Apac...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-19645" }, "impact_statement": "not_affected \u2014 Target Apache Tika 2.9.4-tuxcare.9 uses SQLite version 3.49.1.0 via org.xerial:sqlite-jdbc dependency. CVE-2019-19645 affects SQLite through version 3.30.1 (infinite recursion in alter.c when processing ALTER TABLE statements on self-referential views). Since 3.49.1.0 >> 3.30.1, the vulnerable code pattern is not present. The fix was applied by upstream SQLite project and inherited through Apac..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2019-19646 is a false positive for org.apache.tika:tika-core 2.9.4-tuxcare.7. CVE-2019-19646 is a defect in SQLite's own C source: pragma.c mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns. NVD records the flaw against SQLite through 3.30.1, and SQLite fixed it in release 3.31.0.\n\nApache Tika is a Java library and contains no SQLite code. Its tree carries no sqlite3.c, no pragma.c and no bundled SQLite native library, neither in this version nor at any point in its history. SQLite is reached only through the separate third-party JDBC driver org.xerial:sqlite-jdbc, declared as a dependency of tika-parser-sqlite3-module; Tika's own parser classes SQLite3DBParser and SQLite3TableReader issue only ordinary JDBC queries.\n\nThe vulnerable code therefore belongs to a different product and is never Apache Tika's own code, in any version.", "vulnerability": { "name": "CVE-2019-19646" }, "impact_statement": "CVE-2019-19646 is a defect in SQLite's own C source: pragma.c mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns. NVD records the flaw against SQLite through 3.30.1, and SQLite fixed it in release 3.31.0.\n\nApache Tika is a Java library and contains no SQLite code. Its tree carries no sqlite3.c, no pragma.c and no bundled SQLite native library, neither in this version nor at any point in its history. SQLite is reached only through the separate third-party JDBC driver org.xerial:sqlite-jdbc, declared as a dependency of tika-parser-sqlite3-module; Tika's own parser classes SQLite3DBParser and SQLite3TableReader issue only ordinary JDBC queries.\n\nThe vulnerable code therefore belongs to a different product and is never Apache Tika's own code, in any version." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-11655 is a false positive for org.apache.tika:tika-core 2.9.4-tuxcare.7. CVE-2020-11655 is a defect in the SQLite C library: through SQLite 3.31.1, a malformed window-function query mishandles initialization of the AggInfo object and can crash the process. NVD records the flaw against sqlite/sqlite and against operating-system and product distributors of that C library, and every reference points to SQLite's own ticket af4556bb5c and check-in 4a302b42c7bf5e11. The fix landed in SQLite 3.32.0, in C code.\n\nApache Tika contains no SQLite implementation in any version. Its SQLite support is JDBC glue only: SQLite3Parser and SQLite3DBParser open a JDBC connection and issue SELECT statements, and the SQLite engine itself reaches Tika solely as the native library inside the third-party org.xerial:sqlite-jdbc artifact. The tree holds no sqlite3.c, no sqlite3.h, and no AggInfo or window-function code.\n\nThe vulnerability therefore does not apply to Apache Tika in any version.", "vulnerability": { "name": "CVE-2020-11655" }, "impact_statement": "CVE-2020-11655 is a defect in the SQLite C library: through SQLite 3.31.1, a malformed window-function query mishandles initialization of the AggInfo object and can crash the process. NVD records the flaw against sqlite/sqlite and against operating-system and product distributors of that C library, and every reference points to SQLite's own ticket af4556bb5c and check-in 4a302b42c7bf5e11. The fix landed in SQLite 3.32.0, in C code.\n\nApache Tika contains no SQLite implementation in any version. Its SQLite support is JDBC glue only: SQLite3Parser and SQLite3DBParser open a JDBC connection and issue SELECT statements, and the SQLite engine itself reaches Tika solely as the native library inside the third-party org.xerial:sqlite-jdbc artifact. The tree holds no sqlite3.c, no sqlite3.h, and no AggInfo or window-function code.\n\nThe vulnerability therefore does not apply to Apache Tika in any version." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-11656 is a false positive for org.apache.tika:tika-core 2.9.4-tuxcare.7. CVE-2020-11656 is a use-after-free in the ALTER TABLE implementation of the SQLite C library, reachable through an ORDER BY clause that belongs to a compound SELECT. It affects SQLite up to 3.31.1 and was fixed in SQLite 3.32.0; SQLite records it as a read-only use-after-free that occurs only in builds compiled with -DSQLITE_DEBUG. NVD lists the flaw solely against cpe:2.3:a:sqlite:sqlite:*, with no Apache Tika product entry.\n\nApache Tika contains no SQLite code. Its entire history holds no SQLite C sources, and its only SQLite-related code, tika-parser-sqlite3-module, is Java that opens databases through the JDBC API: SQLite3DBParser calls SQLiteConfig.createConnection. The SQLite engine reaches Tika only inside the third-party artifact org.xerial:sqlite-jdbc, declared as an external dependency.\n\nThe vulnerability is therefore not in Apache Tika's code in any version.", "vulnerability": { "name": "CVE-2020-11656" }, "impact_statement": "CVE-2020-11656 is a use-after-free in the ALTER TABLE implementation of the SQLite C library, reachable through an ORDER BY clause that belongs to a compound SELECT. It affects SQLite up to 3.31.1 and was fixed in SQLite 3.32.0; SQLite records it as a read-only use-after-free that occurs only in builds compiled with -DSQLITE_DEBUG. NVD lists the flaw solely against cpe:2.3:a:sqlite:sqlite:*, with no Apache Tika product entry.\n\nApache Tika contains no SQLite code. Its entire history holds no SQLite C sources, and its only SQLite-related code, tika-parser-sqlite3-module, is Java that opens databases through the JDBC API: SQLite3DBParser calls SQLiteConfig.createConnection. The SQLite engine reaches Tika only inside the third-party artifact org.xerial:sqlite-jdbc, declared as an external dependency.\n\nThe vulnerability is therefore not in Apache Tika's code in any version." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-13434 does not affect version 2.9.4-tuxcare.7 of org.apache.tika:tika-core. not_affected \u2014 CVE-2020-13434 affects SQLite through version 3.32.0 (integer overflow in sqlite3_str_vappendf in printf.c). The target uses sqlite-jdbc 3.49.1.0, which bundles SQLite 3.49.1\u2014significantly newer than both the vulnerable version (3.32.0) and the fix version (3.34.0) introduced by upstream patches. The vulnerable C code exists only in the sqlite-jdbc dependency, not in Tika's repository. The depe...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-13434" }, "impact_statement": "not_affected \u2014 CVE-2020-13434 affects SQLite through version 3.32.0 (integer overflow in sqlite3_str_vappendf in printf.c). The target uses sqlite-jdbc 3.49.1.0, which bundles SQLite 3.49.1\u2014significantly newer than both the vulnerable version (3.32.0) and the fix version (3.34.0) introduced by upstream patches. The vulnerable C code exists only in the sqlite-jdbc dependency, not in Tika's repository. The depe..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-13435 does not affect version 2.9.4-tuxcare.7 of org.apache.tika:tika-core. not_affected \u2014 CVE-2020-13435 affects SQLite through version 3.32.0. The target (Apache Tika 2.9.4-tuxcare.9) uses sqlite-jdbc 3.49.1.0, which bundles native SQLite 3.49.1 - well beyond the vulnerable version range. The upstream vendor (Apache Software Foundation) fixed this vulnerability in September 2020 by upgrading from sqlite-jdbc 3.31.1 to 3.32.3.2 (commit 46e17b4625a by tallison@apache.org). TuxCare fo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-13435" }, "impact_statement": "not_affected \u2014 CVE-2020-13435 affects SQLite through version 3.32.0. The target (Apache Tika 2.9.4-tuxcare.9) uses sqlite-jdbc 3.49.1.0, which bundles native SQLite 3.49.1 - well beyond the vulnerable version range. The upstream vendor (Apache Software Foundation) fixed this vulnerability in September 2020 by upgrading from sqlite-jdbc 3.31.1 to 3.32.3.2 (commit 46e17b4625a by tallison@apache.org). TuxCare fo..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-13630 is a false positive for org.apache.tika:tika-core 2.9.4-tuxcare.7. CVE-2020-13630 is a use-after-free in SQLite's own C implementation: ext/fts3/fts3.c mishandles memory in fts3EvalNextRow when the FTS3 snippet() function is used. SQLite fixed it in check-in 0d69f76f0865f962, released in SQLite 3.32.0, and NVD records the affected product as SQLite together with the operating systems and applications that embed it.\n\nApache Tika contains no part of that implementation. It has never carried SQLite's C sources in any release; the tree holds no fts3 code and no native SQLite library. Tika reads SQLite databases only through JDBC, in the sqlite3 parser module, whose SQLite3DBParser and JDBCTableReader issue nothing but SELECT name FROM sqlite_master and SELECT * from a table name - no full-text-search query and no snippet() call.\n\nThe vulnerability lies in a separate third-party component, not in this library.", "vulnerability": { "name": "CVE-2020-13630" }, "impact_statement": "CVE-2020-13630 is a use-after-free in SQLite's own C implementation: ext/fts3/fts3.c mishandles memory in fts3EvalNextRow when the FTS3 snippet() function is used. SQLite fixed it in check-in 0d69f76f0865f962, released in SQLite 3.32.0, and NVD records the affected product as SQLite together with the operating systems and applications that embed it.\n\nApache Tika contains no part of that implementation. It has never carried SQLite's C sources in any release; the tree holds no fts3 code and no native SQLite library. Tika reads SQLite databases only through JDBC, in the sqlite3 parser module, whose SQLite3DBParser and JDBCTableReader issue nothing but SELECT name FROM sqlite_master and SELECT * from a table name - no full-text-search query and no snippet() call.\n\nThe vulnerability lies in a separate third-party component, not in this library." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-13631 does not affect version 2.9.4-tuxcare.7 of org.apache.tika:tika-core. not_affected \u2014 The target repository (Apache Tika 2.9.4-tuxcare.9) is NOT AFFECTED by CVE-2020-13631. The CVE affects SQLite before version 3.32.0, which allows virtual tables to be renamed to shadow table names. The target uses SQLite version 3.49.1.0 (via org.xerial:sqlite-jdbc dependency), which is far beyond the fixed version 3.32.0. The vulnerability was addressed by upstream Apache Tika in December 2020...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-13631" }, "impact_statement": "not_affected \u2014 The target repository (Apache Tika 2.9.4-tuxcare.9) is NOT AFFECTED by CVE-2020-13631. The CVE affects SQLite before version 3.32.0, which allows virtual tables to be renamed to shadow table names. The target uses SQLite version 3.49.1.0 (via org.xerial:sqlite-jdbc dependency), which is far beyond the fixed version 3.32.0. The vulnerability was addressed by upstream Apache Tika in December 2020..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-13632 does not affect version 2.9.4-tuxcare.7 of org.apache.tika:tika-core. not_affected \u2014 CVE-2020-13632 affects SQLite versions before 3.32.0. The target uses org.xerial:sqlite-jdbc version 3.49.1.0 (declared in tika-parent/pom.xml), which is well above the fixed version. The vulnerability was eliminated when Apache Tika updated the dependency from 3.31.1 to 3.32.3.2 in upstream commit a504d7e7e (TIKA-3119) by tallison@apache.org. Since this is an upstream vendor fix (not a TuxCare...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-13632" }, "impact_statement": "not_affected \u2014 CVE-2020-13632 affects SQLite versions before 3.32.0. The target uses org.xerial:sqlite-jdbc version 3.49.1.0 (declared in tika-parent/pom.xml), which is well above the fixed version. The vulnerability was eliminated when Apache Tika updated the dependency from 3.31.1 to 3.32.3.2 in upstream commit a504d7e7e (TIKA-3119) by tallison@apache.org. Since this is an upstream vendor fix (not a TuxCare..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-15358 does not affect version 2.9.4-tuxcare.7 of org.apache.tika:tika-core. not_affected \u2014 CVE-2020-15358 affects SQLite before version 3.32.3. Apache Tika 2.9.4-tuxcare.9 uses org.xerial:sqlite-jdbc version 3.49.1.0, which contains SQLite 3.49.1. This version is significantly newer than 3.32.3 and includes the fix for the query-flattener optimization vulnerability. The vulnerable code pattern is not present in the version used by the target. The fix was applied by upstream Apache Ti...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-15358" }, "impact_statement": "not_affected \u2014 CVE-2020-15358 affects SQLite before version 3.32.3. Apache Tika 2.9.4-tuxcare.9 uses org.xerial:sqlite-jdbc version 3.49.1.0, which contains SQLite 3.49.1. This version is significantly newer than 3.32.3 and includes the fix for the query-flattener optimization vulnerability. The vulnerable code pattern is not present in the version used by the target. The fix was applied by upstream Apache Ti..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7" } } ], "timestamp": "2026-11-02T19:46:53.056227+00:00", "status_notes": "Vulnerability CVE-2022-30126 does not affect version 2.9.4-tuxcare.7 of org.apache.tika:tika-core. not_affected \u2014 Apache Tika 2.9.4 is not affected by CVE-2022-30126. The vulnerable regex patterns with unbounded quantifiers in StandardsText.java were fixed in upstream commit 3f0078639 (TIKA-3781, May 31, 2022) by adding bounded quantifiers with possessive modifiers to prevent backtracking, plus a 100KB buffer limit in StandardsExtractingContentHandler. This upstream fix was already present in the Apache Ti...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-30126" }, "impact_statement": "not_affected \u2014 Apache Tika 2.9.4 is not affected by CVE-2022-30126. The vulnerable regex patterns with unbounded quantifiers in StandardsText.java were fixed in upstream commit 3f0078639 (TIKA-3781, May 31, 2022) by adding bounded quantifiers with possessive modifiers to prevent backtracking, plus a 100KB buffer limit in StandardsExtractingContentHandler. This upstream fix was already present in the Apache Ti..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7" } } ], "timestamp": "2026-11-02T19:46:11.344168+00:00", "status_notes": "Vulnerability CVE-2022-30973 does not affect version 2.9.4-tuxcare.7 of org.apache.tika:tika-core. not_affected \u2014 CVE-2022-30973 describes a failure to backport the fix for CVE-2022-30126 to Apache Tika's 1.x branch (specifically 1.28.2, later fixed in 1.28.3). The vulnerability involves unbounded regex quantifiers in StandardsText class that could cause catastrophic backtracking (ReDoS). The target repository is Apache Tika 2.9.4-tuxcare.10, which belongs to the 2.x branch. The 2.x branch received compreh...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-30973" }, "impact_statement": "not_affected \u2014 CVE-2022-30973 describes a failure to backport the fix for CVE-2022-30126 to Apache Tika's 1.x branch (specifically 1.28.2, later fixed in 1.28.3). The vulnerability involves unbounded regex quantifiers in StandardsText class that could cause catastrophic backtracking (ReDoS). The target repository is Apache Tika 2.9.4-tuxcare.10, which belongs to the 2.x branch. The 2.x branch received compreh..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-35737 is a false positive for org.apache.tika:tika-core 2.9.4-tuxcare.7. CVE-2022-35737 is an array-bounds overflow in the native SQLite C library, in the printf implementation in src/printf.c. It is reachable only through SQLite's C-language APIs when a string argument longer than about two billion bytes is passed to the %q, %Q or %w quote-escaping specifiers, and SQLite states it cannot be reached through SQL or by supplying a corrupt database file. It was fixed in SQLite 3.39.2.\n\nApache Tika contains no SQLite implementation in any version. Its SQLite support is a JDBC client: SQLite3Parser, SQLite3DBParser and SQLite3TableReader in tika-parser-sqlite3-module open a read-only connection through org.sqlite.JDBC and read tables with prepared statements. The vulnerable C code lives in the native library compiled into the org.xerial:sqlite-jdbc artifact, never in this project's own sources.\n\nThe vulnerability therefore does not apply to this library.", "vulnerability": { "name": "CVE-2022-35737" }, "impact_statement": "CVE-2022-35737 is an array-bounds overflow in the native SQLite C library, in the printf implementation in src/printf.c. It is reachable only through SQLite's C-language APIs when a string argument longer than about two billion bytes is passed to the %q, %Q or %w quote-escaping specifiers, and SQLite states it cannot be reached through SQL or by supplying a corrupt database file. It was fixed in SQLite 3.39.2.\n\nApache Tika contains no SQLite implementation in any version. Its SQLite support is a JDBC client: SQLite3Parser, SQLite3DBParser and SQLite3TableReader in tika-parser-sqlite3-module open a read-only connection through org.sqlite.JDBC and read tables with prepared statements. The vulnerable C code lives in the native library compiled into the org.xerial:sqlite-jdbc artifact, never in this project's own sources.\n\nThe vulnerability therefore does not apply to this library." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-7104 is a false positive for org.apache.tika:tika-core 2.9.4-tuxcare.7. CVE-2023-7104 is a heap buffer overread in the SQLite C library's session extension: sessionReadRecord in ext/session/sqlite3session.c mis-validates bounds while parsing a corrupt changeset. NVD records the affected product as SQLite up to 3.43.0, and the fix is SQLite check-in 0e4e7a05c4204b47, first released in SQLite 3.43.1.\n\nApache Tika implements no part of SQLite. The tree carries no SQLite C sources and no bundled native SQLite library. Its only SQLite code is Java, in tika-parser-sqlite3-module: SQLite3DBParser opens a read-only jdbc:sqlite: connection through the org.sqlite.JDBC driver and reads table names and rows with SELECT statements. It never touches the session or changeset API.\n\nThe vulnerable code is therefore not this library's code in any version. It exists only in the SQLite C library compiled into the separate org.xerial:sqlite-jdbc artifact.", "vulnerability": { "name": "CVE-2023-7104" }, "impact_statement": "CVE-2023-7104 is a heap buffer overread in the SQLite C library's session extension: sessionReadRecord in ext/session/sqlite3session.c mis-validates bounds while parsing a corrupt changeset. NVD records the affected product as SQLite up to 3.43.0, and the fix is SQLite check-in 0e4e7a05c4204b47, first released in SQLite 3.43.1.\n\nApache Tika implements no part of SQLite. The tree carries no SQLite C sources and no bundled native SQLite library. Its only SQLite code is Java, in tika-parser-sqlite3-module: SQLite3DBParser opens a read-only jdbc:sqlite: connection through the org.sqlite.JDBC driver and reads table names and rows with SELECT statements. It never touches the session or changeset API.\n\nThe vulnerable code is therefore not this library's code in any version. It exists only in the SQLite C library compiled into the separate org.xerial:sqlite-jdbc artifact." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.tika/tika-core@2.9.4-tuxcare.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66516 is fixed in version 2.9.4-tuxcare.7 of org.apache.tika:tika-core.", "vulnerability": { "name": "CVE-2025-66516" } } ] }