High
tika — security advisory
In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.
- Products
- tika
- Affected versions
- 1.22-2, 1.5-2, 1.5-3, 1.5-4, 1.5-4ubuntu0.1, 1.5-5
- Fixed versions
- Not specified
- CVEs
- CVE-2018-11761
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 00:23 UTC · Revision 1
Source evidence
In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.
osv:UBUNTU-CVE-2018-11761
tika
Fixed versions: Not specified
tika
Fixed versions: Not specified
tika
Fixed versions: Not specified
tika
Fixed versions: Not specified
tika
Fixed versions: Not specified
Complete source record
{
"id": "7f79333db50887df69d6d06b2219c62ea3e5b007aa5091c8b84a78b1d57314ce",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2018-11761",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2018-11761",
"summary": "In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.",
"evidence": "osv:UBUNTU-CVE-2018-11761",
"products": [
{
"name": {
"value": "tika",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.5-2",
"evidence": "/affected/0/versions"
},
{
"value": "1.5-3",
"evidence": "/affected/0/versions"
},
{
"value": "1.5-4",
"evidence": "/affected/0/versions"
},
{
"value": "1.5-4ubuntu0.1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "tika",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.5-5",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "tika",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.22-2",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "tika",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.22-2",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "tika",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.22-2",
"evidence": "/affected/4/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "UBUNTU-CVE-2018-11761",
"aliases": [
"UBUNTU-CVE-2018-11761"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "low"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "tika",
"purl": "pkg:deb/ubuntu/tika?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"1.5-2",
"1.5-3",
"1.5-4",
"1.5-4ubuntu0.1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-11761.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libtika-java",
"binary_version": "1.5-4ubuntu0.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "tika",
"purl": "pkg:deb/ubuntu/tika?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"1.5-5"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-11761.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libtika-java",
"binary_version": "1.5-5"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "tika",
"purl": "pkg:deb/ubuntu/tika?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"1.22-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-11761.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libtika-java",
"binary_version": "1.22-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "tika",
"purl": "pkg:deb/ubuntu/tika?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"1.22-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-11761.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libtika-java",
"binary_version": "1.22-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "tika",
"purl": "pkg:deb/ubuntu/tika?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"1.22-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-11761.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libtika-java",
"binary_version": "1.22-2"
}
]
}
}
],
"modified": "2026-10-17T12:54:18.826053896Z",
"provider": "osv",
"upstream": [
"CVE-2018-11761"
],
"references": [
"https://ubuntu.com/security/CVE-2018-11761",
"https://www.openwall.com/lists/oss-security/2018/09/19/4",
"https://lists.apache.org/thread.html/5553e10bba5604117967466618f219c0cae710075819c70cfb3fb421@%3Cdev.tika.apache.org%3E",
"https://www.cve.org/CVERecord?id=CVE-2018-11761"
]
},
"related_cves": [
{
"value": "CVE-2018-11761",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 353504,
"published_at": "2018-09-19T14:29:00+00:00"
}