VYPR
← All advisories
High severityNVD Advisory· Published Aug 2, 2019· Updated Aug 4, 2024

CVE-2019-10094

CVE-2019-10094

Description

A carefully crafted package/compressed file that, when unzipped/uncompressed yields the same file (a quine), causes a StackOverflowError in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Apache Tika users should upgrade to 1.22 or later.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A quine zip file causes StackOverflowError in Apache Tika RecursiveParserWrapper (versions 1.7-1.21); upgrade to 1.22.

Vulnerability

Overview

CVE-2019-10094 is a denial-of-service vulnerability in Apache Tika's RecursiveParserWrapper, affecting versions 1.7 through 1.21. The wrapper is designed to recursively parse embedded files within archives. A specially crafted compressed file that, when decompressed, yields an identical copy of itself (a quine) triggers infinite recursion. This leads to a StackOverflowError because the parser lacks a depth limit or cycle detection mechanism [1].

Exploitation

An attacker can exploit this vulnerability by supplying a malicious file to any Tika instance that uses RecursiveParserWrapper. No authentication is required if the service accepts user-uploaded content. The attack is straightforward: the quine archive acts as a zip bomb, causing the parser to recurse indefinitely until the stack overflows.

Impact

Successful exploitation results in a denial-of-service condition. The application crashes due to the stack overflow, potentially disrupting services that rely on Tika for file content extraction. There is no evidence of code execution or data compromise.

Mitigation

Apache Tika users should upgrade to version 1.22 or later, which includes a fix that prevents infinite recursion. No workaround is documented for earlier versions [1].

References
  1. NVD - CVE-2019-10094

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.tika:tika-coreMaven
>= 1.7, < 1.221.22

Affected products

47

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

14

News mentions

0

No linked articles in our index yet.