❌

Normal view

Received yesterday — 12 December 2025
Received before yesterday

Apache Tika Vulnerability Widens Across Multiple Modules, Severity Now 10.0

✇Cybersecurity News and Magazine
By:Ashish Khaitan
9 December 2025 at 02:18

Apache Tika

A security issue disclosed in the Apache Tika document-processing framework has proved broader and more serious than first believed. The project’s maintainers have issued a new advisory revealing that a flaw previously thought to be limited to a single PDF-processing component extends across several Tika modules, widening the scope of a vulnerability first publicized in mid-2025. 

Initial Disclosure and the Limits of CVE-2025-54988 

The original flaw, listed as CVE-2025-54988 and published in August with a severity rating of 8.4, was traced to the tika-parser-pdf-module used to process PDFs in Apache Tika from versions 1.13 through 3.2.1. Tika, a tool designed to extract and standardize content from more than 1,000 proprietary file formats, has long been a target for attacks involving XML External Entity (XXE) injection, a recurring risk in software that parses complex document formats.  According to the original CVE description, the weakness allowed attackers to hide XML Forms Architecture (XFA) instructions inside a malicious PDF. When processed, these instructions could enable an XXE injection attack, potentially letting an attacker “read sensitive data or trigger malicious requests to internal resources or third-party servers.” The vulnerability also created a pathway for data exfiltration through Tika’s own processing pipeline, with no outward indication that data was leaking. 

New CVE Expands Affected Components and Severity 

Project maintainers now report that the PDF parser was not the only vulnerable entry point. A new advisory issued on 4 December 2025 by Tim Allison on the Tika mailing list confirms that the issue affects additional components. The newly disclosed CVE-2025-66516, rated at a maximum severity of 10.0, expands the scope to include: 
  • Apache Tika core (tika-core) versions 1.13 through 3.2.1 
  • Apache Tika parsers (tika-parsers) versions 1.13 through 1.28.5 
  • Apache Tika PDF parser module (tika-parser-pdf-module) versions 2.0.0 through 3.2.1 
The maintainers note two reasons for issuing a second CVE. First, although the vulnerability was detected via the PDF parser, the underlying flaw and its fix were located in tika-core. This means that users who updated only the PDF parser after the initial disclosure but did not update Tika core to version 3.2.2 or later remain exposed. Second, earlier Tika versions housed the PDFParser class within the tika-parsers module, which was not included in the initial CVE despite being vulnerable. The advisory states that CVE-2025-66516 “covers the same vulnerability as in CVE-2025-54988,” but widens the list of affected packages to ensure users understand the full extent of the risk. 

Impact, Exploitation Risk, and Recommended Mitigation 

As of early December, maintainers say they have no evidence that attackers are exploiting the weakness in real-world campaigns. Still, the potential for rapid exploitation remains high, particularly if proofs-of-concept or reverse-engineered attack samples begin circulating.  To eliminate the vulnerability, users are instructed to update to: 
  • tika-core 3.2.2 
  • tika-parser-pdf-module 3.2.2 
  • tika-parsers 2.0.0 (for legacy users) 
The maintainers warn that patching may be insufficient in environments where Apache Tika is used indirectly or embedded within other applications. Its presence is not always clearly documented, creating blind spots for developers. The advisory notes that disabling XML parsing via tika-config.xml is the only mitigation for teams uncertain about where Tika may be running. 

Funding Expires for Key Cyber Vulnerability Database

✇Krebs on Security
By:BrianKrebs
15 April 2025 at 23:59

A critical resource that cybersecurity professionals worldwide rely on to identify, mitigate and fix security vulnerabilities in software and hardware is in danger of breaking down. The federally funded, non-profit research and development organization MITRE warned today that its contract to maintain the Common Vulnerabilities and Exposures (CVE) program — which is traditionally funded each year by the Department of Homeland Security — expires on April 16.

A letter from MITRE vice president Yosry Barsoum, warning that the funding for the CVE program will expire on April 16, 2025.

Tens of thousands of security flaws in software are found and reported every year, and these vulnerabilities are eventually assigned their own unique CVE tracking number (e.g. CVE-2024-43573, which is a Microsoft Windows bug that Redmond patched last year).

There are hundreds of organizations — known as CVE Numbering Authorities (CNAs) — that are authorized by MITRE to bestow these CVE numbers on newly reported flaws. Many of these CNAs are country and government-specific, or tied to individual software vendors or vulnerability disclosure platforms (a.k.a. bug bounty programs).

Put simply, MITRE is a critical, widely-used resource for centralizing and standardizing information on software vulnerabilities. That means the pipeline of information it supplies is plugged into an array of cybersecurity tools and services that help organizations identify and patch security holes — ideally before malware or malcontents can wriggle through them.

“What the CVE lists really provide is a standardized way to describe the severity of that defect, and a centralized repository listing which versions of which products are defective and need to be updated,” said Matt Tait, chief operating officer of Corellium, a cybersecurity firm that sells phone-virtualization software for finding security flaws.

In a letter sent today to the CVE board, MITRE Vice President Yosry Barsoum warned that on April 16, 2025, “the current contracting pathway for MITRE to develop, operate and modernize CVE and several other related programs will expire.”

“If a break in service were to occur, we anticipate multiple impacts to CVE, including deterioration of national vulnerability databases and advisories, tool vendors, incident response operations, and all manner of critical infrastructure,” Barsoum wrote.

MITRE told KrebsOnSecurity the CVE website listing vulnerabilities will remain up after the funding expires, but that new CVEs won’t be added after April 16.

A representation of how a vulnerability becomes a CVE, and how that information is consumed. Image: James Berthoty, Latio Tech, via LinkedIn.

DHS officials did not immediately respond to a request for comment. The program is funded through DHS’s Cybersecurity & Infrastructure Security Agency (CISA), which is currently facing deep budget and staffing cuts by the Trump administration. The CVE contract available at USAspending.gov says the project was awarded approximately $40 million last year.

Former CISA Director Jen Easterly said the CVE program is a bit like the Dewey Decimal System, but for cybersecurity.

“It’s the global catalog that helps everyone—security teams, software vendors, researchers, governments—organize and talk about vulnerabilities using the same reference system,” Easterly said in a post on LinkedIn. “Without it, everyone is using a different catalog or no catalog at all, no one knows if they’re talking about the same problem, defenders waste precious time figuring out what’s wrong, and worst of all, threat actors take advantage of the confusion.”

John Hammond, principal security researcher at the managed security firm Huntress, told Reuters he swore out loud when he heard the news that CVE’s funding was in jeopardy, and that losing the CVE program would be like losing “the language and lingo we used to address problems in cybersecurity.”

“I really can’t help but think this is just going to hurt,” said Hammond, who posted a Youtube video to vent about the situation and alert others.

Several people close to the matter told KrebsOnSecurity this is not the first time the CVE program’s budget has been left in funding limbo until the last minute. Barsoum’s letter, which was apparently leaked, sounded a hopeful note, saying the government is making “considerable efforts to continue MITRE’s role in support of the program.”

Tait said that without the CVE program, risk managers inside companies would need to continuously monitor many other places for information about new vulnerabilities that may jeopardize the security of their IT networks. Meaning, it may become more common that software updates get mis-prioritized, with companies having hackable software deployed for longer than they otherwise would, he said.

“Hopefully they will resolve this, but otherwise the list will rapidly fall out of date and stop being useful,” he said.

Update, April 16, 11:00 a.m. ET: The CVE board today announced the creation of non-profit entity called The CVE Foundation that will continue the program’s work under a new, unspecified funding mechanism and organizational structure.

“Since its inception, the CVE Program has operated as a U.S. government-funded initiative, with oversight and management provided under contract,” the press release reads. “While this structure has supported the program’s growth, it has also raised longstanding concerns among members of the CVE Board about the sustainability and neutrality of a globally relied-upon resource being tied to a single government sponsor.”

The organization’s website, thecvefoundation.org, is less than a day old and currently hosts no content other than the press release heralding its creation. The announcement said the foundation would release more information about its structure and transition planning in the coming days.

Update, April 16, 4:26 p.m. ET: MITRE issued a statement today saying it “identified incremental funding to keep the programs operational. We appreciate the overwhelming support for these programs that have been expressed by the global cyber community, industry and government over the last 24 hours. The government continues to make considerable efforts to support MITRE’s role in the program and MITRE remains committed to CVE and CWE as global resources.”

❌