VYPR
← All advisories
Moderate severityNVD Advisory· Published Dec 24, 2018· Updated Aug 5, 2024

CVE-2018-17197

CVE-2018-17197

Description

A carefully crafted or corrupt sqlite file can cause an infinite loop in Apache Tika's SQLite3Parser in versions 1.8-1.19.1 of Apache Tika.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A specially crafted SQLite file causes an infinite loop in Apache Tika's SQLite3Parser (1.8-1.19.1), leading to denial of service.

Vulnerability

Apache Tika versions 1.8 through 1.19.1 contain a denial of service vulnerability in the SQLite3Parser component. A carefully crafted or corrupt SQLite file can trigger an infinite loop when the parser attempts to process it, causing the application to hang or exhaust resources. The affected versions are those using the tika-parsers module [1][2].

Exploitation

An attacker requires the ability to supply a malicious SQLite file to Apache Tika for parsing. This can be achieved through any mechanism where Tika processes user-uploaded or externally provided files, such as a document conversion service or content extraction pipeline. No authentication or special privileges are needed; the attacker simply provides the crafted file as input [1][2].

Impact

Successful exploitation results in a denial of service condition. The infinite loop prevents the parser from completing its task, consuming CPU resources potentially indefinitely, and may cause the application to become unresponsive. The impact is limited to availability; there is no evidence of information disclosure, data corruption, or remote code execution [1][2].

Mitigation

The vulnerability is fixed in Apache Tika version 1.20, which was released in December 2018. Users should upgrade to version 1.20 or later. There is no known workaround for earlier versions. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog [1][2].

References
  1. NVD - CVE-2018-17197
  2. CVE-2018-17197 - GitHub Advisory Database

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.tika:tika-parsersMaven
>= 1.8, < 1.201.20

Affected products

42

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

9

News mentions

0

No linked articles in our index yet.