title: Incomplete fix and new regex DoS in StandardsExtractingContentHandler
description: The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate, new regex DoS in a different regex in the StandardsExtractingContentHandler. These are now fixed in 1.28.4 and 2.4.1.
problem types: Regex Denial Of Service
affected:
{
product: Apache Tika
vendor: Apache Software Foundation
versions:
changes: [at: 1.28.4, status: unaffected], lessThan: 2.4.1, status: affected, version: Apache Tika, versionType: custom
}
metrics:
other: [
content: {'other': 'low'}
type: unknown
]