Vulnerability Apache Tika 1.13 < 3.2.2 XXE (CVE-2025-66516) and Apache Log4j 2.0-beta9 < 2.25.3 MitM in VA scan report of server

Ravinder07Sharma
Tue, 03 Feb 2026 11:51:46 +0000
Elasticsearch

we are running Elasticsearch-8.17.10 on 6 RHEL 8 servers. But we are getting vulnerability Apache Tika 1.13 < 3.2.2 XXE (CVE-2025-66516) and Apache Log4j 2.0-beta9 < 2.25.3 MitM in VA scan report of server. log4j vulnerability is not getting fixed by upgrading elasticsearch to version 8.19.10.How to fix these vulnerabilities?

2 posts - 2 participants