CVE-2021-28657: 
Java vulnerability analysis and mitigation

A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. The vulnerability was identified as CVE-2021-28657 and affects Apache Tika versions through 1.25. Users are advised to upgrade to Apache Tika version 1.26 or later (Apache Tika Advisory).

The vulnerability is classified as a Loop with Unreachable Exit Condition (Infinite Loop) weakness (CWE-835). It has a CVSS v3.1 Base Score of 5.5 (MEDIUM) with the following vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. The vulnerability requires local access and user interaction, but no privileges, and can affect system availability (NVD).

When successfully exploited, this vulnerability could lead to Denial of Service (DoS) through an infinite loop in the MP3Parser component. The vulnerability affects system availability but does not impact confidentiality or integrity (NetApp Advisory).

The vulnerability requires local access and user interaction to exploit. It can be triggered by a carefully crafted or corrupt MP3 file processed by the affected versions of Apache Tika. The vulnerability has been assigned a low attack complexity rating (NVD).

The primary mitigation is to upgrade to Apache Tika version 1.26 or later. This version contains the fix for the infinite loop vulnerability in the MP3Parser component (Apache Tika Advisory).