CVE-2026-32889: Denial of Service Vulnerability in tinytag Due to Non-Terminating SYLT Frame Parsing Loop
Summary
CVE-2026-32889: Denial of service via non-terminating SYLT frame parsing loop in tinytag. Affects tinytag versions < 2.2.1. Fixed in 2.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tinytag is a Python library designed for reading metadata from audio files, including MP3s. It supports various audio formats and is widely used for extracting information such as title, artist, album, and more. The library's ease of use and lightweight nature make it a popular choice among developers. However, version 2.2.0 introduced a vulnerability that allows an attacker to exploit the SYLT frame parsing, leading to potential denial of service.
Vulnerability Detail
The vulnerability in tinytag arises from a non-terminating loop during the parsing of ID3v2 SYLT (synchronized lyrics) frames. When an attacker supplies a specially crafted MP3 file, the library can enter an infinite loop, consuming system resources and causing the application to hang. This issue is rooted in the assumption made by the _parse_synced_lyrics function that a string terminator will always be present. If the terminator is missing, the parser resets its offset to zero, leading to a continuous loop without progress. This vulnerability can severely impact server-side applications that process user-uploaded files, potentially tying up resources indefinitely.
How To Fix
Minimum fixed version
2.2.1
This is the first release that contains the fix.
pip install --upgrade "tinytag==2.2.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid processing untrusted MP3 files until you can update to the patched version. Additionally, implement file validation to check for the presence of expected terminators in SYLT frames before parsing.
Conclusion
The CVE-2026-32889 vulnerability in the tinytag library poses a significant risk of denial of service due to a flaw in SYLT frame parsing. It is crucial for developers using this library to update to the latest version to mitigate this risk. Utilizing tools like Vulert can aid in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for tinytag →
FAQ
CVE-2026-32889 is a vulnerability in the tinytag library that allows for denial of service due to a non-terminating loop in SYLT frame parsing.
If your application uses tinytag version 2.2.0 or earlier, it is vulnerable. You can check your application's dependencies using tools like Vulert.
An attacker can exploit this vulnerability to cause your application to hang, leading to denial of service and potential resource exhaustion.
Yes, the vulnerability has been patched in tinytag version 2.2.1. Updating to this version will resolve the issue.
Vulert monitors and alerts in real-time for open-source vulnerabilities in your software using just the Pipfile.lock, allowing you to stay informed about potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for tinytag.
