GHSA-927q-g9w9-pm54 Panic in mp3-metadata due to the lack of bounds checking
A lack of bounds checking in the mp3-metadata library allows attackers to cause a panic and denial of service by providing crafted MP3 data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-927q-g9w9-pm54?
GHSA-927q-g9w9-pm54 is a denial of service vulnerability in mp3-metadata, published on 28 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The get_id3() methods used by mp3_metadata::read_from_slice() does not perform adequate bounds checking when recreating the tag due to the use of desynchronization.
Fixed in Fix index error, released as part of 0.4.0.
Which versions are affected by GHSA-927q-g9w9-pm54?
3 open source packages ship an affected version, including mp3-metadata.
| Package | Affected | Fixed in |
|---|---|---|
mp3-metadata crates.io | All versions | 0.4.0 |
mp3-metadata crates.io | All versions | 0.4.0 |
mp3-metadata crates.io | From 0.0.0-0 | 0.4.0 |
How do I fix GHSA-927q-g9w9-pm54?
Upgrade mp3-metadata to 0.4.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-927q-g9w9-pm54 being exploited?
There is no known exploitation of GHSA-927q-g9w9-pm54 in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2025-0027.