p PatchFirst

PatchFirst · Vulnérabilités récentes

Vulnérabilités de tinytag

Vulnérabilités publiées pour tinytag au cours des 30 derniers jours : 1. Présentes dans le catalogue KEV : 0.

RSS ↗
Filtrer les vulnérabilités
Effacer les filtres

Vulnérabilités : 2

  1. CVE-2026-104266

    Moyenne · CVSS 6.5EPSS 0,25%Correctif disponible

    tinytag: Infinite loop when parsing certain M4A files containing invalid atoms

    tinytag is a Python library for reading audio file metadata. From 2.0.0 until 2.3.0, an M4A file containing a sub-atom with a size of zero inside a ---- atom can cause the metadata parser to stop advancing through the input. The custom-field atom traversal repeatedly processes the malformed location, causing an infinite loop and denying service to a program that reads the crafted file. This issue is fixed in version 2.3.0.

    tinytagPython
    • Mettez à jour vers 2.3.0
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  2. CVE-2026-32889

    Moyenne · CVSS 6.5EPSS 0,51%Correctif disponible

    tinytag: Denial of Service via non-terminating SYLT frame parsing loop

    tinytag is a Python library for reading audio file metadata. Version 2.2.0 allows an attacker who can supply MP3 files for parsing to trigger a non-terminating loop while the library parses an ID3v2 SYLT (synchronized lyrics) frame. In server-side deployments that automatically parse attacker-supplied files, a single 498-byte MP3 can cause the parsing operation to stop making progress and remain busy until the worker or process is terminated. The root cause is that _parse_synced_lyrics assumes _find_string_end_pos always returns a position greater than the current offset. That assumption is false when no string terminator is present in the re

    tinytagPython
    • Mettez à jour vers 2.2.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →