Security Advisory 2026-0084

Details

The RTSP server in gst-rtsp-server contains an out-of-bounds read vulnerability in the parser for the KeyMgmt header. When handling a SETUP request, the parser removes quote characters from the header field values. For values starting with multiple quote characters, the parser copies more data than remains in the parsed value, reading beyond the end of the allocated buffer.

This issue affects all versions of gst-rtsp-server before 1.28.8.

Impact

A remote client can send a crafted SETUP request with a malformed KeyMgmt header to an RTSP server that allows unauthenticated SETUP requests. This causes an out-of-bounds read, which can crash the server process and lead to a denial of service. The bytes read beyond the buffer include adjacent heap data, which may be disclosed if the affected field is logged or exposed by the application.

Solution

The gst-rtsp-server 1.28.8 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• No CVE number assigned or pending

GStreamer 1.28.8 release

• Release Notes
• GStreamer RTSP Server 1.28.8

Patches

• Patch