Medium severity · published Mar 31, 2021
CVE-2021-28657
A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25
5.5
CVSS
2.7%
EPSS
No
On KEV
Description
A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should upgrade to 1.26 or later.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CM
Communications Messaging Server · Oracle
8.1 · source: NVD
HF
Healthcare Foundation · Oracle
7.3.0; 8.0.0; 8.1.0 · source: NVD
PU
Primavera Unifier · Oracle
17.7 through 17.12; 18.8; 19.12; 20.12 · source: NVD
TI
Tika · Apache
through 1.25 · source: NVD
WP
Webcenter Portal · Oracle
12.2.1.3.0; 12.2.1.4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-28657
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-28657
lists.apache.org
https://lists.apache.org/thread.html/r4cbc3f6981cd0a1a482531df9d44e4c42a7f63342a7ba78b7bff8a1b%40%3Cnotifications.james.apache.org%3E
Mailing List
https://lists.apache.org/thread.html/r915add4aa52c60d1b5cf085039cfa73a98d7fae9673374dfd7744b5a%40%3Cdev.tika.apache.org%3E
Third Party Advisory
https://security.netapp.com/advisory/ntap-20210507-0004/
Patch
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch
https://www.oracle.com/security-alerts/cpuoct2021.html
More from Tika
9.8
CVE-2026-66756
Apache Tika: unpack endpoint in tika-server allows configuration with unsecureFeatures=false
9.8
CVE-2025-66516
Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML…
9.8
CVE-2016-6809
Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files
8.8
CVE-2019-10088
A carefully crafted or corrupt zip file can cause an OOM in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21
8.4
CVE-2025-54988
Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection…