GitHub Advisoryadvisory · Maven

GHSA-567x-m4wm-87v8 Infinite loop in Apache Tika

MEDIUM Published 2021-05-10 Modified 2022-04-22 Official page ↗
Aliases
CVE-2021-28657
Ecosystem
Maven
Packages
org.apache.tika:tika
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weaknesses
CWE-400, CWE-835
Reviewed
2021-04-01

Affected packages

• Maven org.apache.tika:tika: < 1.26 → fixed in 1.26

Description

A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should upgrade to 1.26 or later.

Related

Alias · CVE (1)

  • CVE-2021-28657 A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. vulnerability

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-835 Loop with Unreachable Exit Condition weakness

References