CVE-2020-9489

A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or infinite loops in Tika's ICNSParser, MP3Parser, MP4Parser, SAS7BDATParser, OneNoteParser and ImageParser. Apache Tika users should upgrade to 1.24.1 or later. The vulnerabilities in the MP4Parser were partially fixed by upgrading the com.googlecode:isoparser:1.1.22 dependency to org.tallison:isoparser:1.9.41.2. For unrelated security reasons, we upgraded org.apache.cxf to 3.3.6 as part of the 1.24.1 release.

• CWE-835

• https://lists.apache.org/thread.html/r4cbc3f6981cd0a1a482531df9d44e4c42a7f63342a7ba78b7bff8a1b%40%3Cnotifications.james.apache.org%3E
• https://lists.apache.org/thread.html/r4d943777e36ca3aa6305a45da5acccc54ad894f2d5a07186cfa2442c%40%3Cdev.tika.apache.org%3EMailing List, Vendor Advisory
• https://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2020.htmlPatch, Third Party Advisory
• https://lists.apache.org/thread.html/r4cbc3f6981cd0a1a482531df9d44e4c42a7f63342a7ba78b7bff8a1b%40%3Cnotifications.james.apache.org%3E
• https://lists.apache.org/thread.html/r4d943777e36ca3aa6305a45da5acccc54ad894f2d5a07186cfa2442c%40%3Cdev.tika.apache.org%3EMailing List, Vendor Advisory
• https://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2020.htmlPatch, Third Party Advisory

Published

Apr 27, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-9483**Resolved** When use H2/MySQL/TiDB as Apache SkyWalking sto…7.5
• CVE-2020-9484When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.…7
• CVE-2020-9485An issue was found in Apache Airflow versions 1.10.10 and be…6.1
• CVE-2020-9486In Apache NiFi 1.10.0 to 1.11.4, the NiFi stateless executio…7.5
• CVE-2020-9487In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token (one…7.5
• CVE-2020-9488Improper validation of certificate with host mismatch in Apa…3.7
• CVE-2020-9490Apache HTTP Server versions 2.4.20 to 2.4.43. A specially cr…7.5
• CVE-2020-9491In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were pro…7.5
• CVE-2020-9492In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and …8.8
• CVE-2020-9493A deserialization flaw was found in Apache Chainsaw versions…9.8
• CVE-2020-9494Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.10, and 8…7.5
• CVE-2020-9495Apache Archiva login service before 2.2.5 is vulnerable to L…5.3