AIKIDO-2026-955281
tinytag is vulnerable to Denial of Service (DoS)
65
Medium Risk
This Affects:
tinytagTL;DR
tinytag reads audio metadata by iterating over the atoms inside M4A and MP4 containers. When a freeform ---- atom contains a sub-atom whose declared size is zero, the MP4 parser fails to advance past that sub-atom and spins in an endless loop. Reading such a crafted file therefore never returns and keeps the process or worker performing metadata extraction busy until it is killed. The fix reuses the primary atom parsing code path, which enforces proper size checks so zero-sized sub-atoms can no longer stall parsing.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use tinytag to read untrusted or externally supplied M4A/MP4 files.
Background info
tinytag is vulnerable to Denial of Service (DoS) in versions 2.0.0 - 2.2.1.
How to fix this
Upgrade the tinytag library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant