diff --git a/pom.xml b/pom.xml
index de6de1b50a2..13248cdb37c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -238,6 +238,7 @@
         <jsoup.version>1.23.2</jsoup.version>
         <jsr305.version>3.0.2</jsr305.version>
         <jsr305.bundle.version>${jsr305.version}_1</jsr305.bundle.version>
+        <junrar.version>7.6.1</junrar.version>
         <jts.version>1.20.0</jts.version>
         <jts.spatial4j.version>1.18.0</jts.spatial4j.version>
         <jvnet-ogc.version>2.6.1</jvnet-ogc.version>
diff --git a/thirdparty/tika/pom.xml b/thirdparty/tika/pom.xml
index 7aa7e8b098f..6e84c588bec 100644
--- a/thirdparty/tika/pom.xml
+++ b/thirdparty/tika/pom.xml
@@ -22,7 +22,23 @@
 
     <artifactId>tika</artifactId>
     <packaging>bundle</packaging>
-    
+
+    <!-- Override parser transitives that Tika pins below their CVE fix versions. -->
+    <dependencyManagement>
+        <dependencies>
+            <dependency>
+                <groupId>org.jsoup</groupId>
+                <artifactId>jsoup</artifactId>
+                <version>${jsoup.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>com.github.junrar</groupId>
+                <artifactId>junrar</artifactId>
+                <version>${junrar.version}</version>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
+
     <dependencies>
         <dependency>
             <groupId>org.apache.tika</groupId>