Apache Issues Max-Severity Tika CVE After Patch Miss

The Apache Software Foundation (ASF) has issued a new CVE identifier for a critical flaw in Apache Tika after the initial patch missed the full scope, leading to an updated advisory and CVE. According to The Apache Software Foundation (ASF), the new maximum severity CVE-2025-66516 (CVSS score: 10) updates CVE-2025-54988 to address the same underlying flaw but expands the list of affected modules.

Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable, ASF said. CVE-2025-66516 affects both Tika Core and Tika Parsers from versions 1.13 up to and including 3.2.1, and the PDF Module versions 1.13 before 2.0.0 and 2.0.0 through 3.2.1; the issue is fixed in Tika 3.2.2 and later releases. Upgrading to Tika Core to 3.2.2 or later is required to protect against the vulnerability, since updating the PDF module alone is insufficient.