CVE-2026-107388: music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS
The ID3v2 parser in music-metadata trusts the tag size field without validation and allocates the full requested buffer before reading. A specially crafted MP3 file with a truncated ID3v2 tag can force allocation of up to 268 MB from a 10-byte file, causing server memory exhaustion. This vulnerability affects all parsers that support ID3v2 tags (MP3, FLAC, DSF, Musepack) and succeeds silently—callers don’t see an error.
References
- github.com/Borewit/music-metadata/commit/b033db675b913a9dba1d29135ec3c10eae7095a7
- github.com/Borewit/music-metadata/pull/2743
- github.com/Borewit/music-metadata/releases/tag/v11.16.0
- github.com/Borewit/music-metadata/security/advisories/GHSA-jjpr-9cvf-cq55
- github.com/advisories/GHSA-jjpr-9cvf-cq55
- nvd.nist.gov/vuln/detail/CVE-2026-107388
Code Behaviors & Features
Detect and mitigate CVE-2026-107388 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →