{"id":"CVE-2021-21235","aliases":["GHSA-px9g-8hgv-jvg2","RUSTSEC-2021-0143"],"title":"kamadak-exif vulnerable to Infinite loop when parsing PNG files","summary":"kamadak-exif vulnerable to Infinite loop when parsing PNG files","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","vendor":"kamadak-exif","product":"kamadak-exif","ecosystem":"rust","affected":["kamadak-exif >= 0.5.2, < 0.5.3"],"patched":["kamadak-exif 0.5.3"],"published":"2022-10-06","updated":"2026-07-08","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-px9g-8hgv-jvg2","references":[{"url":"https://github.com/kamadak/exif-rs/security/advisories/GHSA-px9g-8hgv-jvg2"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21235"},{"url":"https://github.com/kamadak/exif-rs/commit/1b05eab57e484cd7d576d4357b9cda7fdc57df8c"},{"url":"https://github.com/kamadak/exif-rs/commit/f21df24616ea611c5d5d0e0e2f8042eb74d5ff48"},{"url":"https://crates.io/crates/kamadak-exif"},{"url":"https://github.com/kamadak/exif-rs"},{"url":"https://rustsec.org/advisories/RUSTSEC-2021-0143.html"}],"tags":["osv","rust"],"epss":0.01515,"epssPercentile":0.73397,"ingestedAt":"2026-07-09T18:56:37.325Z","slug":"CVE-2021-21235","body":"## Overview\n\n### Impact\nReader::read_from_container can cause an infinite loop when a crafted PNG file is given.\n\n### Patches\nVersion 0.5.3 includes the fix.\n\n### Workarounds\nNo workaround is available.\nApplications that do not pass files with the PNG signature to Reader::read_from_container are not affected.\n\n### References\n* <https://github.com/kamadak/exif-rs/security/advisories/GHSA-px9g-8hgv-jvg2>\n* <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21235>\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [github.com/kamadak/exif-rs](https://github.com/kamadak/exif-rs)\n\n## Affected packages\n\n- `kamadak-exif >= 0.5.2, < 0.5.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `kamadak-exif 0.5.3`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}