CVE-2018-11761: In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion.

Security readout for executives and security teams

Apache Tika versions 0.1 through 1.18 could be made to consume excessive resources while parsing specially crafted XML content. The disclosed impact is denial of service, not data theft or code execution. Business urgency depends on whether Tika processes untrusted files in customer-facing or critical workflows. Exposure is most likely where Apache Tika 0.1 to 1.18 parses user-supplied documents, XML, uploads, email attachments, or indexed content. Systems that only process trusted internal files have lower practical exposure, though dependency presence should still be verified. Treat this as a availability risk for services that parse untrusted content. Prioritize customer-facing upload, search, eDiscovery, mail, and content-indexing systems. It is less urgent than confirmed exploited code execution, but should not remain in critical parsing paths. Mitigation focus: Inventory applications and transitive dependencies using Apache Tika.; Flag Apache Tika versions 0.1 through 1.18 for remediation review.; Check Apache Tika advisory guidance for fixed versions or vendor-approved mitigations..

Prepared

Jun 7, 2026, 05:35 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.