helperpy (>=0.0.1, <=0.0.4) potentially affected by CVE-2026-32889 via tinytag (1.5.0)

tinytag PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on tinytag and may be impacted: - helperpy =0.0.1, =0.0.4 Source cves: CVE-2026-32889 Source advisory: OSV:PYSEC-2026-3386...

ahwaz (2.2.3), arseinrubika (>=4.8.0, <=5.4.4) +7 more potentially affected by CVE-2026-32889 via tinytag (1.8.1)

tinytag PYPI version 1.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on tinytag and may be impacted: - ahwaz 2.2.3 - arseinrubika =4.8.0, =3.8.5, =2.7.5, =1.92.0, =1.113.0 Source cves: CVE-2026-32889 Source advisory: OSV:PYSEC-2026-3386...

bosesoundtouchapi (>=1.0.20, <=1.0.87) potentially affected by CVE-2026-32889 via tinytag (1.10.0)

tinytag PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on tinytag and may be impacted: - bosesoundtouchapi =1.0.20, =1.0.87 Source cves: CVE-2026-32889 Source advisory: OSV:PYSEC-2026-3386...

arkive (>=0.1.1, <=0.3.1), arsein (>=7.8.2, <=7.8.6) +33 more potentially affected by CVE-2026-32889 via tinytag (1.10.1)

tinytag PYPI version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on tinytag and may be impacted: - arkive =0.1.1, =7.8.2, =7.0.0, =0.0.20, =1.0.0, =1.9.0, =0.1.0, =1.1.0b12, =0.1.41, =0.1.0, =0.1.0, =0.1.1 - mdinfo-macos 0.1.0 and more Source...

bsh-file-validation (>=0.0.4, <=0.0.21), kaithem (0.95.0) +2 more potentially affected by CVE-2026-32889 via tinytag (>=2.1.0, <=2.2.0)

tinytag PYPI version =2.1.0, =0.0.4, =0.11.12rc1, =0.11.12 - pyplanet-currentcps 1.1.0 Source cves: CVE-2026-32889 Source advisory: OSV:PYSEC-2026-3386...

PT-2026-60000

Summary tinytag 2.2.0 allows an attacker who can supply MP3 files for parsing to trigger a non-terminating loop while the library parses an ID3v2 SYLT synchronized lyrics frame. In server-side deployments that automatically parse attacker-supplied files, a single 498-byte MP3 can cause the parsin...

CVE-2026-32889

A flaw was found in tinytag, a Python library for reading audio file metadata. An attacker who can supply specially crafted MP3 files for parsing can trigger a non-terminating loop within the library. This can cause the parsing operation to stop making progress, leading to a Denial of Service DoS...

Infinite loop

Overview tinytag is a Read audio file metadata Affected versions of this package are vulnerable to Infinite loop via a non-terminating SYLT frame parsing loop. An attacker can cause the application to become unresponsive by supplying a specially crafted MP3 file containing a SYLT frame without a...

kaithem (0.95.0) potentially affected by CVE-2026-32889 via tinytag (2.2.0)

tinytag PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on tinytag and may be impacted: - kaithem 0.95.0 Source cves: CVE-2026-32889 Source advisory: SNYK:PYTHON-TINYTAG-15763573...

CVE-2026-32889

tinytag is a Python library for reading audio file metadata. Version 2.2.0 allows an attacker who can supply MP3 files for parsing to trigger a non-terminating loop while the library parses an ID3v2 SYLT synchronized lyrics frame. In server-side deployments that automatically parse...

CVE-2026-32889 tinytag: Denial of Service via non-terminating SYLT frame parsing loop

tinytag is a Python library for reading audio file metadata. Version 2.2.0 allows an attacker who can supply MP3 files for parsing to trigger a non-terminating loop while the library parses an ID3v2 SYLT synchronized lyrics frame. In server-side deployments that automatically parse...

CVE-2026-32889 tinytag: Denial of Service via non-terminating SYLT frame parsing loop

tinytag is a Python library for reading audio file metadata. Version 2.2.0 allows an attacker who can supply MP3 files for parsing to trigger a non-terminating loop while the library parses an ID3v2 SYLT synchronized lyrics frame. In server-side deployments that automatically parse...

CVE-2026-32889

tinytag is a Python library for reading audio file metadata. Version 2.2.0 allows an attacker who can supply MP3 files for parsing to trigger a non-terminating loop while the library parses an ID3v2 SYLT synchronized lyrics frame. In server-side deployments that automatically parse...

CVE-2026-32889 tinytag: Denial of Service via non-terminating SYLT frame parsing loop

tinytag is a Python library for reading audio file metadata. Version 2.2.0 allows an attacker who can supply MP3 files for parsing to trigger a non-terminating loop while the library parses an ID3v2 SYLT synchronized lyrics frame. In server-side deployments that automatically parse...

ahwaz (2.2.3), arkive (>=0.1.1, <=0.3.1) +47 more potentially affected by CVE-2026-32889 via tinytag (>=0.18.0, <=2.2.0)

tinytag PYPI version =0.18.0, =0.1.1, =7.8.2, =4.8.0, =0.0.20, =1.0.20, =0.0.4, =1.0.0, =1.9.0, =0.1.0, =0.0.1, =3.8.5, =1.1.0b12, =1.1.0b17 and more Source cves: CVE-2026-32889 Source advisory: MEND:CVE-2026-32889...

CVE-2026-32889

Tinytag (Python) version 2.2.0 is affected by a Denial of Service via a non-terminating SYLT frame parsing loop when processing attacker-supplied MP3s. The root cause is in _parse_synced_lyrics/_find_string_end_pos where an absent string terminator can cause the parser to reset its offset and nev...

Tinytag security vulnerabilities

Tinytag is a Python library developed by Tinytag that reads metadata from audio files. Version 2.2.0 of Tinytag contains a security vulnerability. This vulnerability stems from an incorrect assumption during the parsing of ID3v2 SYLT frames, which may lead to non-terminating loops and cause...

CVE-2026-32889: Loop with Unreachable Exit Condition

tinytag is a Python library for reading audio file metadata. Version 2.2.0 allows an attacker who can supply MP3 files for parsing to trigger a non-terminating loop while the library parses an ID3v2 SYLT synchronized lyrics frame. In server-side deployments that automatically parse...

GHSA-F4RQ-2259-HV29 Denial of service via non-terminating SYLT frame parsing loop in tinytag

Summary tinytag 2.2.0 allows an attacker who can supply MP3 files for parsing to trigger a non-terminating loop while the library parses an ID3v2 SYLT synchronized lyrics frame. In server-side deployments that automatically parse attacker-supplied files, a single 498-byte MP3 can cause the parsin...

Denial of service via non-terminating SYLT frame parsing loop in tinytag

Summary tinytag 2.2.0 allows an attacker who can supply MP3 files for parsing to trigger a non-terminating loop while the library parses an ID3v2 SYLT synchronized lyrics frame. In server-side deployments that automatically parse attacker-supplied files, a single 498-byte MP3 can cause the parsin...