Tim Allison created TIKA-4964:
---------------------------------
Summary: Limit multi-part attachment sizes for tika-server
Key: TIKA-4964
URL: https://issues.apache.org/jira/browse/TIKA-4964
Project: Tika
Issue Type: Task
Reporter: Tim Allison
In Tika 3.x, cxf 4.0.x is no longer supported for Java 11. This means we
cannot get security updates at all for cxf in Tika 3.x unless we bump the
required jre.
We should try to do what we can to protect against CVE-2026-57819. The fix on
the cxf side was to add a default 50MB limit.
I propose that we default to the 50MB limit in Tika 3.x and Tika 4.x but allow
users to configure their way to whatever they need.
The point of the fix is to default limit to 50MB in 3.x and to allow a setting
in 4.x so that users can override cxf's new surprise default.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
