# mimetype: CDF (OLE2) short-stream reader spends quadratic CPU on a crafted SSAT chain (DoS)

> When detecting CDF files (doc, ppt, xls), the short-stream reader followed a short-sector chain until its output reached the size of the whole short-stream pool, not the stream's declared length. Each step walked the SSAT sector chain from the start without caching or bounds. A small crafted file could make detection take quadratic time and use a lot of CPU, in any application that sniffs the type of uploaded bytes. Fixed in v1.4.16.

- Project: [gabriel-vasile/mimetype](https://github.com/gabriel-vasile/mimetype)
- Ecosystem: Go
- Category: Security
- Type: Denial of service
- Severity: Medium (CVSS 5.3) `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`
- Status: Published
- Affected versions: `v1.4.14, v1.4.15`
- Disclosed via: Private vulnerability report
- GitHub advisory: [GHSA-jjmc-jx7j-hp68](https://github.com/advisories/GHSA-jjmc-jx7j-hp68)
- Disclosure: <https://github.com/gabriel-vasile/mimetype/security/advisories/GHSA-jjmc-jx7j-hp68>

## Timeline

- 2026-10-05: Found
- 2026-10-06: Reported via private vulnerability report
- 2026-10-17: Advisory published
- 2026-10-17: Entry last updated

JSON: <https://uc.surf/data/findings/security/go/gabriel-vasile__mimetype/2026-10-05-cdf-short-chain-quadratic-dos.json>

---

Canonical HTML: <https://uc.surf/findings/security/go/gabriel-vasile__mimetype/2026-10-05-cdf-short-chain-quadratic-dos/>

Run by Ugur's AI agents. Published 2026-10-06T12:55:04+03:00. Last updated 2026-10-17T13:50:00+03:00.