Read the docs
TI-2021-09726 Aliases CVE-2021-28657GHSA-567x-m4wm-87v8

Infinite loop in Apache Tika's MP3 parser

Priority LOW 30CWE-835Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 9 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-835.

Summary

A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should upgrade to 1.26 or later.

Why it matters now

EPSS 0.02739 86th percentileScored 2026-11-07
Fix Partial Apache Tika (Apache Software Foundation): 1.26org.apache.tika:tika (Maven): 1.26Red Hat: 9 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache TikaApache Tika to before 1.261.26Patch availableCNA
—org.apache.tika:tika (Maven)before 1.261.26Patch availableGHSA-567x-m4wm-87v8
  • Apache Tika VendorApache Affected Apache Tika to before 1.26 Fixed in 1.26 Patch available CNA
  • org.apache.tika:tika (Maven) Vendor— Affected before 1.26 Fixed in 1.26 Patch available GHSA-567x-m4wm-87v8

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:a:apache:tika:*:*:*:*:*:*:*:*up to 1.25VulnerableApache
cpe:2.3:a:oracle:healthcare_foundation:7.3.0:*:*:*:*:*:*:*7.3.0VulnerableOracle
cpe:2.3:a:oracle:healthcare_foundation:8.0.0:*:*:*:*:*:*:*8.0.0VulnerableOracle
cpe:2.3:a:oracle:healthcare_foundation:8.1.0:*:*:*:*:*:*:*8.1.0VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*17.7 – 17.12VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*18.8VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*19.12VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:*20.12VulnerableOracle
cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
  • cpe:2.3:a:apache:tika:*:*:*:*:*:*:*:* Versions up to 1.25 Vulnerable ·Apache
  • cpe:2.3:a:oracle:healthcare_foundation:7.3.0:*:*:*:*:*:*:* Versions 7.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:healthcare_foundation:8.0.0:*:*:*:*:*:*:* Versions 8.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:healthcare_foundation:8.1.0:*:*:*:*:*:*:* Versions 8.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* Versions 17.7 – 17.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* Versions 18.8 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:* Versions 19.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:* Versions 20.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:*8.1VulnerableOracle
  • cpe:2.3:o:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Oracle

Remediation

  • Fix · CNA Apache Tika (Apache Software Foundation) Fixed in 1.26
  • Fix · GHSA-567x-m4wm-87v8 org.apache.tika:tika (Maven) Fixed in 1.26 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat BPM Suite 6AffectedNo fix planned: Out of support scope
Red Hat Fuse 7AffectedNo fix yet: Fix deferred
Red Hat Integration Camel K 1AffectedNo fix yet: Fix deferred
Red Hat Integration Camel Quarkus 1AffectedNo fix yet: Fix deferred
Red Hat JBoss BRMS 5AffectedNo fix planned: Out of support scope
Red Hat JBoss BRMS 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-28657
  2. 2026-10-03 Alias added: GHSA-567x-m4wm-87v8

References

Patch 2

Advisory 3

Other 3

  • TI-2025-40938 XML external entity injection in Apache Tika core CVSS 3.1CRITICAL 9.8
  • TI-2018-01236 From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to… CVSS 3.0HIGH 8.1
  • TI-2025-34694 Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFA CVSS 3.1CRITICAL 9.8
  • TI-2016-05850 Apache Tika before 1.14 allows Java code execution for serialized objects embedded in… CVSS 3.1CRITICAL 9.8
  • TI-2021-13169 An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of… CVSS 3.1HIGH 7.5
  • TI-2019-07413 Resource allocation without limits in Apache Tika CVSS 3.0HIGH 8.8
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences