GHSA-567x-m4wm-87v8

Infinite loop in Apache Tika

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-28657

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.apache.tika:tika	< 1.26	1.26

Details

As written in the advisory (Markdown source, shown as plain text).

A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should upgrade to 1.26 or later.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-28657 advisory
https://lists.apache.org/thread.html/r4cbc3f6981cd0a1a482531df9d44e4c42a7f63342a7ba78b7bff8a1b@%3Cnotifications.james.apache.org%3E web
https://lists.apache.org/thread.html/r915add4aa52c60d1b5cf085039cfa73a98d7fae9673374dfd7744b5a%40%3Cdev.tika.apache.org%3E web
https://security.netapp.com/advisory/ntap-20210507-0004 web
https://www.oracle.com/security-alerts/cpuapr2022.html web
https://www.oracle.com/security-alerts/cpuoct2021.html web