VYPR
← All advisories
High severityNVD Advisory· Published Aug 2, 2019· Updated Aug 4, 2024

CVE-2019-10088

CVE-2019-10088

Description

A carefully crafted or corrupt zip file can cause an OOM in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Users should upgrade to 1.22 or later.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A crafted zip file can cause a denial of service (OOM) in Apache Tika's RecursiveParserWrapper versions 1.7 to 1.21.

Vulnerability

Overview

CVE-2019-10088 is a denial-of-service vulnerability in Apache Tika, a content analysis toolkit. A carefully crafted or corrupt zip file can trigger an out-of-memory (OOM) condition in the RecursiveParserWrapper component, crashing the application. The issue affects Apache Tika versions 1.7 through 1.21 [1].

Attack

Vector

An attacker exploits this flaw by delivering a malicious ZIP file to a vulnerable Apache Tika instance. No authentication is required if the attacker can provide the file directly (e.g., via upload), making the attack surface broad in environments where untrusted files are processed.

Impact

Successful exploitation results in a denial of service—the application runs out of memory and becomes unavailable. This can disrupt services relying on Apache Tika for document parsing, such as content extraction or file analysis pipelines.

Mitigation

Apache Tika version 1.22 fixes the vulnerability by improving memory handling during zip processing. Users are advised to upgrade to 1.22 or later. No workaround is provided in the advisory [1].

References
  1. NVD - CVE-2019-10088

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.tika:tika-coreMaven
>= 1.7, < 1.221.22

Affected products

47

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

16

News mentions

0

No linked articles in our index yet.