CVE-2021-28657 Infinite loop in Apache Tika's MP3 parser

2021-03-3107:35:14

CWE-835

apache

www.cve.org

6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

34.8%

JSON

A carefully crafted or corrupt file may trigger an infinite loop in Tika’s MP3Parser up to and including Tika 1.25. Apache Tika users should upgrade to 1.26 or later.

CNA Affected

[
  {
    "product": "Apache Tika",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "1.26",
        "status": "affected",
        "version": "Apache Tika",
        "versionType": "custom"
      }
    ]
  }
]