What is the CVSS score of CVE-2026-32889?

CVE-2026-32889 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Python are affected by CVE-2026-32889?

Organizations using tinytag should be aware of notable risk from CVE-2026-32889 rated CVSS 6.5. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-32889?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Python CVE-2026-32889

MEDIUM

Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)

2026-03-20 security-advisories@github.com

GHSA-f4rq-2259-hv29

Python Denial Of Service

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Red Hat

6.5 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 20, 2026 - 08:37 vuln.today

CVE Published

Mar 20, 2026 - 03:15 nvd

MEDIUM 6.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1,242 pypi packages depend on tinytag (50 direct, 1,192 indirect)

Ecosystem-wide dependent count for version 2.2.1.

DescriptionGitHub Advisory

tinytag is a Python library for reading audio file metadata. Version 2.2.0 allows an attacker who can supply MP3 files for parsing to trigger a non-terminating loop while the library parses an ID3v2 SYLT (synchronized lyrics) frame. In server-side deployments that automatically parse attacker-supplied files, a single 498-byte MP3 can cause the parsing operation to stop making progress and remain busy until the worker or process is terminated. The root cause is that _parse_synced_lyrics assumes _find_string_end_pos always returns a position greater than the current offset. That assumption is false when no string terminator is present in the remaining frame content. This issue has been fixed in version 2.2.1.

AnalysisAI

A non-terminating loop denial-of-service vulnerability exists in tinytag version 2.2.0, a Python library for reading audio file metadata. An attacker can supply a malicious MP3 file containing a crafted ID3v2 SYLT (synchronized lyrics) frame that causes the parsing operation to enter an infinite loop, consuming CPU resources until the worker process is terminated. The vulnerability affects server-side deployments that automatically parse user-supplied files, and has been patched in version 2.2.1.

Technical ContextAI

tinytag is a Python library designed to extract metadata from audio files including MP3, OGG, FLAC, and other formats. The vulnerability resides in the _parse_synced_lyrics method, which processes ID3v2 SYLT frames—a standard ID3v2 tag structure used for embedding synchronized lyrics in MP3 files. The root cause falls under CWE-835 (Loop with Unreachable Exit Condition), specifically where the _parse_synced_lyrics function makes an unsafe assumption that the _find_string_end_pos helper function always returns a position strictly greater than the current offset. When processing a malformed SYLT frame lacking a proper string terminator in its remaining content, _find_string_end_pos returns a position equal to or less than the current offset, causing the parsing loop to never advance and remain in an infinite iteration. This is a classic infinite loop vulnerability triggered by insufficient input validation and boundary checking in frame parsing logic.

RemediationAI

Upgrade tinytag to version 2.2.1 or later immediately using pip (pip install --upgrade tinytag>=2.2.1) or equivalent package management tools. Verify the upgrade by checking the installed version with pip show tinytag or examining your requirements.txt/poetry.lock files. Until patching is feasible, implement timeout mechanisms for file parsing operations (e.g., using Python's signal.alarm() or multiprocessing.Process with timeout parameters) to kill hanging parsers after a reasonable duration (5-30 seconds depending on expected file sizes). Additionally, restrict MP3 file parsing to authenticated users where possible, validate SYLT frame structure before parsing, and consider disabling ID3v2 SYLT frame parsing if not required for your application. Monitor process resource usage and implement rate-limiting on file upload endpoints to limit the impact of malicious file submissions. For the latest patch details and commit references, consult the official GitHub security advisory at https://github.com/tinytag/tinytag/security/advisories/GHSA-f4rq-2259-hv29.