Security Advisory 2026-0074

Details

The RTP session management component in gst-plugins-good had no limit on the number of sources it would track. When processing incoming RTP packets, it would create and store a new source entry for every unknown synchronization source identifier and contributing source identifier without any capacity check. Since the RTP protocol allows up to 15 contributing source identifiers per packet, a remote sender could send valid RTP packets that cause linear growth of the internal source table and memory usage. This could continue until the process exhausts available memory. The attack uses only protocol-compliant RTP packets and does not rely on malformed data.

Impact

A malicious third party could trigger resource exhaustion by sending valid RTP packets with new source identifiers to an RTP receiving session, potentially resulting in denial of service through memory exhaustion. There is no risk of code execution or data leakage.

Solution

The gst-plugins-good 1.28.6 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• No CVE number assigned or pending

GStreamer 1.28.6 release

• Release Notes
• GStreamer Plugins Good 1.28.6

Patches

• Patch