CVE-2019-10093
UnknownEPSS 3.70%
Last modified
CVE-2019-10093 is a vulnerability of currently unknown severity. In Apache Tika 1.19 to 1.21, a carefully crafted 2003ml or 2006ml file could consume all available SAXParsers in the pool and lead to very long hangs. Apache Tika users should upgrade to 1.22 or later.. EPSS estimates a 3.70% chance of exploitation in the next 30 days.
Description
In Apache Tika 1.19 to 1.21, a carefully crafted 2003ml or 2006ml file could consume all available SAXParsers in the pool and lead to very long hangs. Apache Tika users should upgrade to 1.22 or later.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Tika | >= 1.19, <= 1.21 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-10093?
In Apache Tika 1.19 to 1.21, a carefully crafted 2003ml or 2006ml file could consume all available SAXParsers in the pool and lead to very long hangs. Apache Tika users should upgrade to 1.22 or later.
How severe is CVE-2019-10093?
Severity scoring for CVE-2019-10093 is pending analysis. The EPSS model estimates a 3.70% probability of exploitation in the next 30 days.
How do I fix CVE-2019-10093?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-10088A carefully crafted or corrupt zip file can cause an OOM in …
- CVE-2019-10089On Apache JSPWiki, up to version 2.11.0.M4, a carefully craf…6.1
- CVE-2019-1009An information disclosure vulnerability exists when the Wind…4.7
- CVE-2019-10090On Apache JSPWiki, up to version 2.11.0.M4, a carefully craf…6.1
- CVE-2019-10091When TLS is enabled with ssl-endpoint-identification-enabled…7.4
- CVE-2019-10092In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scr…6.1
- CVE-2019-10094A carefully crafted package/compressed file that, when unzip…
- CVE-2019-10095bash command injection vulnerability in Apache Zeppelin allo…9.8
- CVE-2019-10096Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2019-10097In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was c…7.2
- CVE-2019-10098In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured …6.1
- CVE-2019-10099Prior to Spark 2.3.3, in certain situations Spark would writ…7.5
Are you affected by CVE-2019-10093?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST