CVE-2026-31808

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31808", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-09T16:33:42.913Z", "datePublished": "2026-03-10T21:01:55.466Z", "dateUpdated": "2026-03-11T16:00:14.754Z"}, "containers": {"cna": {"title": "file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header", "problemTypes": [{"descriptions": [{"cweId": "CWE-835", "lang": "en", "description": "CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/sindresorhus/file-type/security/advisories/GHSA-5v7r-6r5c-r473", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/sindresorhus/file-type/security/advisories/GHSA-5v7r-6r5c-r473"}, {"name": "https://github.com/sindresorhus/file-type/commit/319abf871b50ba2fa221b4a7050059f1ae096f4f", "tags": ["x_refsource_MISC"], "url": "https://github.com/sindresorhus/file-type/commit/319abf871b50ba2fa221b4a7050059f1ae096f4f"}], "affected": [{"vendor": "sindresorhus", "product": "file-type", "versions": [{"version": ">= 13.0.0, < 21.3.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-10T21:01:55.466Z"}, "descriptions": [{"lang": "en", "value": "file-type detects the file type of a file, stream, or data. Prior to 21.3.1, a denial of service vulnerability exists in the ASF (WMV/WMA) file type detection parser. When parsing a crafted input where an ASF sub-header has a size field of zero, the parser enters an infinite loop. The payload value becomes negative (-24), causing tokenizer.ignore(payload) to move the read position backwards, so the same sub-header is read repeatedly forever. Any application that uses file-type to detect the type of untrusted/attacker-controlled input is affected. An attacker can stall the Node.js event loop with a 55-byte payload. Fixed in version 21.3.1."}], "source": {"advisory": "GHSA-5v7r-6r5c-r473", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-11T15:53:37.941340Z", "id": "CVE-2026-31808", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T16:00:14.754Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header", "source": {"advisory": "GHSA-5v7r-6r5c-r473", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "sindresorhus", "product": "file-type", "versions": [{"status": "affected", "version": ">= 13.0.0, < 21.3.1"}]}], "references": [{"url": "https://github.com/sindresorhus/file-type/security/advisories/GHSA-5v7r-6r5c-r473", "name": "https://github.com/sindresorhus/file-type/security/advisories/GHSA-5v7r-6r5c-r473", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/sindresorhus/file-type/commit/319abf871b50ba2fa221b4a7050059f1ae096f4f", "name": "https://github.com/sindresorhus/file-type/commit/319abf871b50ba2fa221b4a7050059f1ae096f4f", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "file-type detects the file type of a file, stream, or data. Prior to 21.3.1, a denial of service vulnerability exists in the ASF (WMV/WMA) file type detection parser. When parsing a crafted input where an ASF sub-header has a size field of zero, the parser enters an infinite loop. The payload value becomes negative (-24), causing tokenizer.ignore(payload) to move the read position backwards, so the same sub-header is read repeatedly forever. Any application that uses file-type to detect the type of untrusted/attacker-controlled input is affected. An attacker can stall the Node.js event loop with a 55-byte payload. Fixed in version 21.3.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-835", "description": "CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-10T21:01:55.466Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31808", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-11T15:53:37.941340Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-03-11T15:53:39.314Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-31808", "state": "PUBLISHED", "dateUpdated": "2026-03-10T21:01:55.466Z", "dateReserved": "2026-03-09T16:33:42.913Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-10T21:01:55.466Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "file-type", "vendor": "sindresorhus", "versions": [{"status": "affected", "version": ">= 13.0.0, < 21.3.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sindresorhus:file-type:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "6A5F1C18-775C-4C3E-B4D7-332961814056", "versionEndExcluding": "21.3.1", "versionStartIncluding": "13.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "file-type detects the file type of a file, stream, or data. Prior to 21.3.1, a denial of service vulnerability exists in the ASF (WMV/WMA) file type detection parser. When parsing a crafted input where an ASF sub-header has a size field of zero, the parser enters an infinite loop. The payload value becomes negative (-24), causing tokenizer.ignore(payload) to move the read position backwards, so the same sub-header is read repeatedly forever. Any application that uses file-type to detect the type of untrusted/attacker-controlled input is affected. An attacker can stall the Node.js event loop with a 55-byte payload. Fixed in version 21.3.1."}, {"lang": "es", "value": "file-type detecta el tipo de archivo de un archivo, flujo o datos. Antes de 21.3.1, existe una vulnerabilidad de denegaci\u00f3n de servicio en el analizador de detecci\u00f3n de tipo de archivo ASF (WMV/WMA). Al analizar una entrada manipulada donde un subencabezado ASF tiene un campo de tama\u00f1o de cero, el analizador entra en un bucle infinito. El valor de la carga \u00fatil se vuelve negativo (-24), haciendo que tokenizer.ignore(payload) mueva la posici\u00f3n de lectura hacia atr\u00e1s, por lo que el mismo subencabezado se lee repetidamente para siempre. Cualquier aplicaci\u00f3n que utiliza file-type para detectar el tipo de entrada no confiable/controlada por el atacante se ve afectada. Un atacante puede paralizar el bucle de eventos de Node.js con una carga \u00fatil de 55 bytes. Corregido en la versi\u00f3n 21.3.1."}], "id": "CVE-2026-31808", "lastModified": "2026-06-17T10:34:30.063", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31808", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-11T15:53:37.941340Z", "version": "2.0.3"}}]}, "published": "2026-03-10T21:16:50.173", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/sindresorhus/file-type/commit/319abf871b50ba2fa221b4a7050059f1ae096f4f"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "url": "https://github.com/sindresorhus/file-type/security/advisories/GHSA-5v7r-6r5c-r473"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-835"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "file-type: file-type: Denial of Service due to infinite loop in ASF file parsing", "id": "2446309", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446309"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-835", "details": ["No description is available for this CVE."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-31808", "package_state": [{"cpe": "cpe:/a:redhat:cryostat:4", "fix_state": "Fix deferred", "package_name": "io.cryostat-cryostat", "product_name": "Cryostat 4"}, {"cpe": "cpe:/a:redhat:logging:5", "fix_state": "Fix deferred", "package_name": "openshift-logging/elasticsearch6-rhel9", "product_name": "Logging Subsystem for Red Hat OpenShift"}, {"cpe": "cpe:/a:redhat:logging:5", "fix_state": "Fix deferred", "package_name": "openshift-logging/elasticsearch-operator-bundle", "product_name": "Logging Subsystem for Red Hat OpenShift"}, {"cpe": "cpe:/a:redhat:logging:5", "fix_state": "Fix deferred", "package_name": "openshift-logging/elasticsearch-proxy-rhel9", "product_name": "Logging Subsystem for Red Hat OpenShift"}, {"cpe": "cpe:/a:redhat:logging:5", "fix_state": "Fix deferred", "package_name": "openshift-logging/elasticsearch-rhel9-operator", "product_name": "Logging Subsystem for Red Hat OpenShift"}, {"cpe": "cpe:/a:redhat:logging:5", "fix_state": "Fix deferred", "package_name": "openshift-logging/kibana6-rhel8", "product_name": "Logging Subsystem for Red Hat OpenShift"}, {"cpe": "cpe:/a:redhat:logging:5", "fix_state": "Fix deferred", "package_name": "openshift-logging/logging-curator5-rhel9", "product_name": "Logging Subsystem for Red Hat OpenShift"}, {"cpe": "cpe:/a:redhat:service_registry:2", "fix_state": "Fix deferred", "package_name": "io.apicurio-apicurio-registry", "product_name": "Red Hat build of Apicurio Registry 2"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:8", "fix_state": "Fix deferred", "package_name": "org.infinispan-infinispan-console", "product_name": "Red Hat Data Grid 8"}, {"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Fix deferred", "package_name": "rhdh/rhdh-hub-rhel9", "product_name": "Red Hat Developer Hub"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rhelai3/bootc-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rhelai3/disk-image-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Fix deferred", "package_name": "devspaces/code-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Fix deferred", "package_name": "devspaces/code-sshd-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Fix deferred", "package_name": "satellite/iop-host-inventory-frontend-rhel9", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:ansible_portal:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform/automation-portal", "product_name": "Self-service automation portal 2"}], "public_date": "2026-03-10T21:01:55Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31808\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31808\nhttps://github.com/sindresorhus/file-type/commit/319abf871b50ba2fa221b4a7050059f1ae096f4f\nhttps://github.com/sindresorhus/file-type/security/advisories/GHSA-5v7r-6r5c-r473"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.0.0,21.3.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "file-type", "source": "cna", "vendor": "sindresorhus"}, "product": "file-type", "vendor": "sindresorhus"}], "analysis": {"en": {"generated_at": "2026-04-16T09:25:44.232550+00:00", "value": {"mitigation_remediation": ["Upgrade the file-type library to version 21.3.1 or higher.", "If an upgrade cannot be performed immediately, remove or disable the ASF parsing capability in file-type (e.g., apply a local patch or configuration that turns off ASF support).", "Avoid passing untrusted or attacker\u2011controlled data directly to file-type; instead, perform additional input validation or use an alternative file\u2011type detection mechanism until the library is fixed."], "summary": {"action": "Immediate Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The affected product is \"sindresorhus:file-type\" used in Node.js applications. Versions prior to 21.3.1 are impacted. Any code that calls file-type to examine user\u2011supplied files, streams, or raw data is vulnerable until the library is upgraded to 21.3.1 or later.", "description_and_impact": "The vulnerability resides in the ASF (WMV/WMA) file type detection parser of the file-type library. When an ASF sub\u2011header\u2019s size field is set to zero, the parser enters an infinite loop. The loop decrements a payload counter to a negative value, causing the tokenizer to move read position backwards and continuously reread the same sub\u2011header, ultimately stalling the Node.js event loop. This denial of service flaw is an instance of CWE\u2011835 (Infinite Loop). This flaw can be triggered by a crafted 55\u2011byte payload and results in a denial of service, disrupting legitimate application processing of untrusted or attacker\u2011controlled data.", "risk_and_exploitability": "The CVSS score of 5.3 indicates a medium impact, while the EPSS score of less than 1% reflects a low probability of exploitation in the general population. The vulnerability is not listed in the CISA KEV catalog. Attackers who can supply crafted ASF content to an application that unconditionally passes data to file-type can cause the event loop to freeze, effectively denying service to all users of that instance. Even though exploitation requires an altered ASF file, the flaw can be triggered with a small, non\u2011malicious looking payload, implying a moderate ease of attack once the condition is met."}}}}, "created": "2026-03-11T11:42:05.887639+00:00", "updated": "2026-04-16T09:30:06.049976+00:00", "vendors": ["sindresorhus", "sindresorhus$PRODUCT$file-type"]}