tinytag: Denial of Service via non-terminating SYLT frame parsing loop
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-835.
Summary
tinytag is a Python library for reading audio file metadata. Version 2.2.0 allows an attacker who can supply MP3 files for parsing to trigger a non-terminating loop while the library parses an ID3v2 SYLT (synchronized lyrics) frame. In server-side deployments that automatically parse attacker-supplied files, a single 498-byte MP3 can cause the parsing operation to stop making progress and remain busy until the worker or process is terminated. The root cause is that _parse_synced_lyrics assumes _find_string_end_pos always returns a position greater than the current offset. That assumption is false when no string terminator is present in the remaining frame content. This issue has been fixed in version 2.2.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| tinytag | tinytag | 2.2.0 to before 2.2.1 | 2.2.1 | Patch available | CNA |
| — | tinytag (PyPI) | before 2.2.1 | 2.2.1 | Patch available | GHSA-f4rq-2259-hv29 |
- tinytag Vendortinytag Affected 2.2.0 to before 2.2.1 Fixed in 2.2.1 Patch available CNA
- tinytag (PyPI) Vendor— Affected before 2.2.1 Fixed in 2.2.1 Patch available GHSA-f4rq-2259-hv29
Remediation
- Fix · CNA tinytag (tinytag) Fixed in 2.2.1
- Fix · GHSA-f4rq-2259-hv29 tinytag (PyPI) Fixed in 2.2.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Lightspeed | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-32889
- 2026-10-03 Alias added: GHSA-f4rq-2259-hv29
References
Patch 3
Sources
- CVE-2026-32889 · CVE Program
- CVE-2026-32889 · NVD
- FIRST EPSS
- GHSA-f4rq-2259-hv29 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-32889 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences