You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@tika.apache.org by Shaik Nayab Rasool <sh...@pnp-hcl.com> on 2026/07/29 04:28:51 UTC
Dependency Upgrade Request - pdfbox-2.0.37 ( CVE-2026-33929)
Hi Team,
Maven released the new pdfbox-2.0.37 version on July 12. Could you please
upgrade the dependency from pdfbox-2.0.36 to pdfbox-2.0.37 in Tika 2.9.5?
This upgrade will resolve the CVE-2026-33929 issue.
Thank you for your support.
Thanks & Regards,
Rasool
Re: Dependency Upgrade Request - pdfbox-2.0.37 ( CVE-2026-33929)
Posted by Tilman Hausherr <TH...@t-online.de>.
Am 29.07.2026 um 09:45 schrieb Shaik Nayab Rasool:
> Thanks for the upgrade. Does the build
> *tika‑server‑standard‑2.9.5‑20260729.065617‑22.jar* include the
> updated *pdfbox‑2.0.37*? Please confirm.
Yes and that CVE isn't related to tika anyway. It's in the examples.
Since then we no longer release the examples as jar, only the sources.
Tilman
> Thanks,
> Rasool
>
> ----- Original message -----
> From: "Tilman Hausherr" <ti...@apache.org>
> To: user@tika.apache.org
> Subject: Re: Dependency Upgrade Request - pdfbox-2.0.37 (
> CVE-2026-33929)
> Date: Wed, Jul 29, 2026 12:29 PM
>
> [CAUTION: This email is from outside the organization. Unless you
> trust the sender, don't click links or open attachments as it may
> be a phishing email, which can steal your information and
> compromise your computer.]
> Done. Be aware that you shouldn't use that. We update it only to
> test pdfbox releases.
>
> Tilman
>
> On 2026/07/29 04:28:51 Shaik Nayab Rasool wrote:
> > Hi Team,
> >
> >
> >
> > Maven released the new pdfbox-2.0.37 version on July 12. Could
> you please
> > upgrade the dependency from pdfbox-2.0.36 to pdfbox-2.0.37 in
> Tika 2.9.5?
> >
> > This upgrade will resolve the CVE-2026-33929 issue.
> >
> >
> >
> > Thank you for your support.
> >
> >
> >
> >
> >
> > Thanks & Regards,
> >
> > Rasool
> >
> >
>
Re: Dependency Upgrade Request - pdfbox-2.0.37 ( CVE-2026-33929)
Posted by Shaik Nayab Rasool <sh...@pnp-hcl.com>.
Thanks for the upgrade. Does the build
**tika‑server‑standard‑2.9.5‑20260729.065617‑22.jar** include the updated
**pdfbox‑2.0.37**? Please confirm.
Thanks,
Rasool
> \----- Original message -----
> From: "Tilman Hausherr" <ti...@apache.org>
> To: user@tika.apache.org
> Subject: Re: Dependency Upgrade Request - pdfbox-2.0.37 ( CVE-2026-33929)
> Date: Wed, Jul 29, 2026 12:29 PM
>
>
>
> [CAUTION: This email is from outside the organization. Unless you trust the
> sender, don't click links or open attachments as it may be a phishing email,
> which can steal your information and compromise your computer.]
> Done. Be aware that you shouldn't use that. We update it only to test pdfbox
> releases.
>
> Tilman
>
> On 2026/07/29 04:28:51 Shaik Nayab Rasool wrote:
> > Hi Team,
> >
> >
> >
> > Maven released the new pdfbox-2.0.37 version on July 12. Could you please
> > upgrade the dependency from pdfbox-2.0.36 to pdfbox-2.0.37 in Tika 2.9.5?
> >
> > This upgrade will resolve the CVE-2026-33929 issue.
> >
> >
> >
> > Thank you for your support.
> >
> >
> >
> >
> >
> > Thanks & Regards,
> >
> > Rasool
> >
> >
>
Re: Dependency Upgrade Request - pdfbox-2.0.37 ( CVE-2026-33929)
Posted by Tilman Hausherr <ti...@apache.org>.
Done. Be aware that you shouldn't use that. We update it only to test pdfbox releases.
Tilman
On 2026/07/29 04:28:51 Shaik Nayab Rasool wrote:
> Hi Team,
>
>
>
> Maven released the new pdfbox-2.0.37 version on July 12. Could you please
> upgrade the dependency from pdfbox-2.0.36 to pdfbox-2.0.37 in Tika 2.9.5?
>
> This upgrade will resolve the CVE-2026-33929 issue.
>
>
>
> Thank you for your support.
>
>
>
>
>
> Thanks & Regards,
>
> Rasool
>
>