CVE-2018-11796

Vulnerability

In Apache Tika versions 0.1 through 1.19- (CVE-2018-11761 introduced a fix that was incomplete), the SAXParser used for XML parsing is reused across multiple parse operations. After each parse, a call to reset() is made on the parser, which for Xerces2 implementations removes the user-specified SecurityManager that enforces entity expansion limits [1][2][4]. This means the expansion limit is only active for the first XML document parsed; subsequent parses revert to default, unlimited behavior, leaving the application vulnerable to denial of service via XML entity expansion attacks.

Exploitation

An attacker can send a crafted XML document to an Apache Tika instance (e.g., via file upload or API endpoint). After the first parse resets the security configuration, the attacker sends a second (or later) XML document containing nested entity expansions that exhaust system memory or CPU time. No special authentication or network position is required if the Tika endpoint is publicly accessible; the attack only requires the ability to submit XML content that Tika will parse [2][4].

Impact

Successful exploitation results in a denial of service (DoS) condition—the Tika process may consume excessive memory or CPU, causing slowdowns or crashes. The vulnerability does not lead to information disclosure, file write, or remote code execution; it is purely a resource exhaustion attack targeting availability. The scope of compromise is limited to the Tika service itself, but it can affect dependent systems consuming Tika output [2][4].

Mitigation

Users should upgrade to Apache Tika 1.19.1 or later, which correctly retains entity expansion limits across SAXParser resets [1][2][4]. Red Hat issued a related advisory (RHSA-2019:3892) for Red Hat Enterprise Linux distributions [1]. No workaround is available for previous versions; the fix is the only complete mitigation. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.