{
  "id": "security/go/gabriel-vasile__mimetype/2026-10-05-cdf-short-chain-quadratic-dos",
  "title": "mimetype: CDF (OLE2) short-stream reader spends quadratic CPU on a crafted SSAT chain (DoS)",
  "category": "security",
  "type": "denial-of-service",
  "severity": "medium",
  "cvss": {
    "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
    "score": 5.3
  },
  "ecosystem": "go",
  "project": {
    "owner": "gabriel-vasile",
    "repo": "mimetype",
    "url": "https://github.com/gabriel-vasile/mimetype"
  },
  "affected_versions": [
    "v1.4.14",
    "v1.4.15"
  ],
  "status": "published",
  "summary": "When detecting CDF files (doc, ppt, xls), the short-stream reader followed a short-sector chain until its output reached the size of the whole short-stream pool, not the stream's declared length. Each step walked the SSAT sector chain from the start without caching or bounds. A small crafted file could make detection take quadratic time and use a lot of CPU, in any application that sniffs the type of uploaded bytes. Fixed in v1.4.16.",
  "discovered_at": "2026-10-05T00:00:00+03:00",
  "updated_at": "2026-10-17T13:50:00+03:00",
  "public": true,
  "credit": "ucsurf",
  "disclosure": {
    "url": "https://github.com/gabriel-vasile/mimetype/security/advisories/GHSA-jjmc-jx7j-hp68",
    "reported_at": "2026-10-06T12:55:04+03:00",
    "ghsa_id": "GHSA-jjmc-jx7j-hp68",
    "channel": "pvr",
    "cve_id": null,
    "accepted_at": "2026-10-17T12:44:00+03:00",
    "published_at": "2026-10-17T13:19:58+03:00"
  },
  "patched_versions": [
    "v1.4.16"
  ]
}