---
id: CVE-2021-21235
aliases:
  - GHSA-px9g-8hgv-jvg2
  - RUSTSEC-2021-0143
title: kamadak-exif vulnerable to Infinite loop when parsing PNG files
summary: kamadak-exif vulnerable to Infinite loop when parsing PNG files
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'
vendor: kamadak-exif
product: kamadak-exif
ecosystem: rust
affected:
  - 'kamadak-exif >= 0.5.2, < 0.5.3'
patched:
  - kamadak-exif 0.5.3
published: '2022-10-06'
updated: '2026-07-08'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-px9g-8hgv-jvg2'
references:
  - url: 'https://github.com/kamadak/exif-rs/security/advisories/GHSA-px9g-8hgv-jvg2'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2021-21235'
  - url: >-
      https://github.com/kamadak/exif-rs/commit/1b05eab57e484cd7d576d4357b9cda7fdc57df8c
  - url: >-
      https://github.com/kamadak/exif-rs/commit/f21df24616ea611c5d5d0e0e2f8042eb74d5ff48
  - url: 'https://crates.io/crates/kamadak-exif'
  - url: 'https://github.com/kamadak/exif-rs'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2021-0143.html'
tags:
  - osv
  - rust
epss: 0.01515
epssPercentile: 0.73397
ingestedAt: '2026-07-09T18:56:37.325Z'
---

## Overview

### Impact
Reader::read_from_container can cause an infinite loop when a crafted PNG file is given.

### Patches
Version 0.5.3 includes the fix.

### Workarounds
No workaround is available.
Applications that do not pass files with the PNG signature to Reader::read_from_container are not affected.

### References
* <https://github.com/kamadak/exif-rs/security/advisories/GHSA-px9g-8hgv-jvg2>
* <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21235>

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [github.com/kamadak/exif-rs](https://github.com/kamadak/exif-rs)

## Affected packages

- `kamadak-exif >= 0.5.2, < 0.5.3`

## Remediation

Upgrade to a patched release:

- `kamadak-exif 0.5.3`