[
https://issues.apache.org/jira/browse/TIKA-4964?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Tim Allison resolved TIKA-4964.
-------------------------------
Fix Version/s: 4.2.0
Resolution: Fixed
> Limit multi-part attachment sizes for tika-server
> -------------------------------------------------
>
> Key: TIKA-4964
> URL: https://issues.apache.org/jira/browse/TIKA-4964
> Project: Tika
> Issue Type: Task
> Reporter: Tim Allison
> Priority: Minor
> Fix For: 4.2.0
>
>
> In Tika 3.x, cxf 4.0.x is no longer supported for Java 11. This means we
> cannot get security updates at all for cxf in Tika 3.x unless we bump the
> required jre.
>
> We should try to do what we can to protect against CVE-2026-57819. The fix on
> the cxf side was to add a default 50MB limit.
>
> I propose that we default to the 50MB limit in Tika 3.x and Tika 4.x but
> allow users to configure their way to whatever they need.
>
> The point of the fix is to default limit to 50MB in 3.x and to allow a
> setting in 4.x so that users can override cxf's new surprise default.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
