Executive brief
GStreamer is a widely-used media streaming framework. A flaw in its RTSP (Real Time Streaming Protocol) authentication handler can be triggered by sending a malformed authentication header, causing the application to crash. On RTSP servers with authentication enabled, an unauthenticated attacker can remotely trigger this crash; RTSP clients are vulnerable if connecting to a malicious server. The impact is service unavailability, with no data loss or unauthorized access.
Technical details
A NULL pointer dereference vulnerability exists in GStreamer's RTSP message parsing function (gst_rtsp_message_parse_auth_credentials) when handling Digest authentication headers. The flaw occurs in the Authorization and WWW-Authenticate header parser, where specially crafted whitespace around parameter delimiters causes an internal length calculation to underflow. An unauthenticated remote attacker can send a single malformed RTSP request to crash an RTSP server with authentication enabled; alternatively, a compromised or malicious RTSP server can trigger the same crash in connected clients. This results in denial of service through process termination. Patches are available in Red Hat Enterprise Linux 10 via gstreamer1-plugins-base version 1.26.7-2.el10_2.2 and later.
Affected products
- GStreamer gstreamer1-plugins-base before 1.26.7-2.el10_2.2
Timeline
- 2026-09-03: disclosed
- 2026-09-10: advisory: Red Hat Security Advisory RHSA-2026:66460 issued