VDB
RHSA-2026:53452
RHSA-2026:53452
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on the reassembly buffer used during fragmented RTP packet processing. A remote, unauthenticated attacker can send a continuous stream of RTP fragments without ever transmitting an end-of-fragment marker, causing the reassembly buffer to grow without bound until process memory is exhausted. This results in a denial of service through process termination.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-7.el9_8.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9) | 1.22.12-7.el9 |
| Red Hat | gstreamer1-plugins-good-debuginfo-0:1.22.12-7.el9_8.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9) | 1.22.12-7.el9 |
| Red Hat | gstreamer1-plugins-good-0:1.22.12-7.el9_8.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9) | 1.22.12-7.el9 |
| Red Hat | gstreamer1-plugins-good-debugsource-0:1.22.12-7.el9_8.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9) | 1.22.12-7.el9 |
| Red Hat | gstreamer1-plugins-good-gtk-0:1.22.12-7.el9_8.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9) | 1.22.12-7.el9 |
| Red Hat | gstreamer1-plugins-good-0:1.22.12-7.el9_8.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9) | 1.22.12-7.el9 |
| Red Hat | gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-7.el9_8.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9) | 1.22.12-7.el9 |
| Red Hat | gstreamer1-plugins-good-gtk-0:1.22.12-7.el9_8.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9) | 1.22.12-7.el9 |
| Red Hat | gstreamer1-plugins-good-gtk-0:1.22.12-7.el9_8.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9) | 1.22.12-7.el9 |
| Red Hat | gstreamer1-plugins-good-debuginfo-0:1.22.12-7.el9_8.2.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9) | 1.22.12-7.el9 |
| Red Hat | gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-7.el9_8.2.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9) | 1.22.12-7.el9 |
| Red Hat | gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-7.el9_8.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9) | 1.22.12-7.el9 |
| Red Hat | gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-7.el9_8.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9) | 1.22.12-7.el9 |
| Red Hat | gstreamer1-plugins-good-debuginfo-0:1.22.12-7.el9_8.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9) | 1.22.12-7.el9 |
| Red Hat | gstreamer1-plugins-good-debugsource-0:1.22.12-7.el9_8.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9) | 1.22.12-7.el9 |
| Red Hat | gstreamer1-plugins-good-0:1.22.12-7.el9_8.2.src as a component of Red Hat Enterprise Linux AppStream (v. 9) | 1.22.12-7.el9 |
| Red Hat | gstreamer1-plugins-good-debuginfo-0:1.22.12-7.el9_8.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9) | 1.22.12-7.el9 |
| Red Hat | gstreamer1-plugins-good-gtk-0:1.22.12-7.el9_8.2.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9) | 1.22.12-7.el9 |
| Red Hat | gstreamer1-plugins-good-0:1.22.12-7.el9_8.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9) | 1.22.12-7.el9 |
| Red Hat | gstreamer1-plugins-good-0:1.22.12-7.el9_8.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9) | 1.22.12-7.el9 |
…and 11 more
Timeline
- Aug 11, 2026 CVE Published
- Sep 9, 2026 CVE Updated
- Sep 9, 2026 Distribution Patch
- Sep 9, 2026 Distribution Patch
- Sep 9, 2026 Security Advisory
- Sep 9, 2026 Security Advisory
References
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_53452.json advisory
- https://access.redhat.com/security/cve/CVE-2026-18649 advisory
- https://www.cve.org/CVERecord?id=CVE-2026-18649 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-18649 advisory
- https://0xsemizzz.vercel.app/blog/cve-2026-18649-gstreamer-rtp-dos/ advisory
- https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/merge_requests/113 advisory
- https://access.redhat.com/errata/RHSA-2026:53452 advisory
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2510614 issue