CVE-2021-28657: Apache Tika

Medium severity, CVSS 5.5. EPSS: 2.8% chance of exploitation in the next 30 days.

A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should upgrade to 1.26 or later.

Affected products

• Apache Tika: up to and including 1.25
• Oracle Communications Messaging Server: version 8.1 only
• Oracle Healthcare Foundation: version 7.3.0 only; version 8.0.0 only; version 8.1.0 only
• Oracle Primavera Unifier: from 17.7, up to and including 17.12; version 18.8 only; version 19.12 only; version 20.12 only
• Oracle Webcenter Portal: version 12.2.1.3.0 only; version 12.2.1.4.0 only

Published 2021-03-31. Last modified 2026-06-17.