borewit/music-metadata Security Advisories | GitStock

medium2026-10-08

music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master

GHSA-f94x-6692-553q · CVE-2026-107391

medium2026-10-08

music-metadata: Uncontrolled memory allocation in APEv2 parser

GHSA-53v6-4h7p-p4gj · CVE-2026-107387

medium2026-10-08

music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS

GHSA-jjpr-9cvf-cq55 · CVE-2026-107388

medium2026-10-08

music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort

GHSA-5gfj-9q3v-qfp3 · CVE-2026-107389

medium2026-10-08

music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of GHSA-v6c2-xwv6-8xf7)

GHSA-8j4c-6x6g-rq3j · CVE-2026-107392

high2026-03-17

music-metadata has an infinite loop vulnerability in ASF parser

GHSA-v6c2-xwv6-8xf7 · CVE-2026-32256