CVE-2026-32889: Denial of service via non-terminating SYLT frame parsing loop in tinytag
(updated )
tinytag 2.2.0 allows an attacker who can supply MP3 files for parsing to trigger a non-terminating loop while the library parses an ID3v2 SYLT (synchronized lyrics) frame. In server-side deployments that automatically parse attacker-supplied files, a single 498-byte MP3 can cause the parsing operation to stop making progress and remain busy until the worker or process is terminated.
References
- github.com/advisories/GHSA-f4rq-2259-hv29
- github.com/tinytag/tinytag
- github.com/tinytag/tinytag/commit/44e496310f7ced8077e9087e3774acbaa324b18a
- github.com/tinytag/tinytag/commit/4d649b9c314ada8ff8a74e0469e9aadb3acb252a
- github.com/tinytag/tinytag/commit/5cd321521ff097e41724b601d7e3d7adc7e53402
- github.com/tinytag/tinytag/security/advisories/GHSA-f4rq-2259-hv29
- nvd.nist.gov/vuln/detail/CVE-2026-32889
Code Behaviors & Features
Detect and mitigate CVE-2026-32889 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →