CVE-2026-32889: tinytag Python Library DoS Vulnerability

CVE-2026-32889 Overview

CVE-2026-32889 is a Denial of Service vulnerability in tinytag, a Python library for reading audio file metadata. Version 2.2.0 of the library contains a flaw that allows an attacker who can supply MP3 files for parsing to trigger a non-terminating loop while the library parses an ID3v2 SYLT (synchronized lyrics) frame.

In server-side deployments that automatically parse attacker-supplied files, a single 498-byte MP3 can cause the parsing operation to stop making progress and remain busy until the worker or process is terminated. This vulnerability is classified as CWE-835 (Loop with Unreachable Exit Condition).

Critical Impact

Server-side applications using tinytag 2.2.0 to parse user-uploaded MP3 files are vulnerable to resource exhaustion attacks, where a single malicious file can render parsing workers permanently unresponsive.

Affected Products

• tinytag version 2.2.0
• Python applications and web services using tinytag 2.2.0 for audio metadata extraction
• Server-side deployments that automatically parse user-supplied MP3 files

Discovery Timeline

• 2026-03-20 - CVE CVE-2026-32889 published to NVD
• 2026-03-20 - Last updated in NVD database

Technical Details for CVE-2026-32889

Vulnerability Analysis

The vulnerability exists in the _parse_synced_lyrics function within tinytag's ID3v2 frame parser. When processing SYLT (synchronized lyrics) frames in MP3 files, the parsing logic enters an infinite loop condition when encountering malformed frame content specifically crafted to exploit the parser's assumptions about string termination.

The attack is network-accessible, meaning remote attackers can exploit this vulnerability by uploading or submitting malicious MP3 files to any service that uses tinytag for metadata extraction. While user interaction is required (the file must be processed by the target system), the attack complexity is low and requires no authentication or special privileges.

The impact is limited to availability—there is no confidentiality or integrity compromise. However, the denial of service effect can be severe in production environments where parsing workers become permanently stuck processing malicious files.

Root Cause

The root cause lies in the _parse_synced_lyrics function's assumption that _find_string_end_pos will always return a position greater than the current offset. This assumption fails when no string terminator is present in the remaining frame content.

When a malformed SYLT frame lacks the expected null terminator for its text content, _find_string_end_pos returns a position that does not advance the parser's current position. This causes the while loop to iterate indefinitely without making progress, as the loop condition is never met and no exit condition is reached.

Attack Vector

The attack vector involves crafting a malicious MP3 file containing a specially constructed ID3v2 SYLT frame. The attacker creates a synchronized lyrics frame where the text content lacks proper null termination. When tinytag attempts to parse this frame, the following sequence occurs:

1. The parser begins reading the SYLT frame content
2. _find_string_end_pos is called to locate the string terminator
3. No terminator is found, causing the function to return a position that does not advance the offset
4. The parsing loop continues indefinitely, consuming CPU resources

The malicious payload requires only 498 bytes, making it trivial to embed in file uploads or submissions. For technical implementation details and the specific fix applied, see the GitHub Security Advisory GHSA-f4rq-2259-hv29.

Detection Methods for CVE-2026-32889

Indicators of Compromise

• Worker processes or threads stuck at 100% CPU utilization during MP3 parsing operations
• Parsing tasks that never complete or exceed normal timeout thresholds
• Accumulation of pending file processing jobs while workers are unresponsive
• Memory pressure from accumulating stuck parser instances

Detection Strategies

• Monitor application logs for parsing operations that exceed expected duration thresholds
• Implement dependency scanning to identify tinytag version 2.2.0 in your Python environments
• Review file upload logs for unusually small MP3 files (under 1KB) that trigger extended processing
• Use Software Composition Analysis (SCA) tools to detect vulnerable library versions

Monitoring Recommendations

• Configure alerting for CPU spikes in services that handle audio file metadata extraction
• Set up process monitoring to detect worker threads that become unresponsive
• Implement parsing timeouts with automatic worker recycling for file processing services
• Enable application performance monitoring (APM) to track parsing operation latencies

How to Mitigate CVE-2026-32889

Immediate Actions Required

• Upgrade tinytag to version 2.2.1 or later immediately
• Audit all Python applications and dependencies for tinytag version 2.2.0
• Implement parsing timeouts for all audio file processing operations
• Consider temporarily disabling automatic MP3 metadata extraction until patching is complete

Patch Information

This vulnerability has been fixed in tinytag version 2.2.1. The fix ensures that the parsing loop properly handles cases where no string terminator is present in frame content, preventing the infinite loop condition.

Multiple commits address this issue:

• Commit 44e4963
• Commit 4d649b9
• Commit 5cd3215

For complete details, refer to the GitHub Security Advisory GHSA-f4rq-2259-hv29.

Workarounds

• Implement strict timeout limits on all MP3 parsing operations to automatically terminate runaway processes
• Use process isolation for file parsing to allow forceful termination without affecting main application
• Validate MP3 file structure before passing to tinytag, rejecting files with malformed ID3v2 frames
• Deploy worker process monitoring with automatic restart capabilities for stuck processes

# Upgrade tinytag to patched version
pip install --upgrade tinytag>=2.2.1

# Verify installed version
pip show tinytag | grep Version

# Check for vulnerable versions in requirements
grep -r "tinytag" requirements*.txt setup.py pyproject.toml