A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on the reassembly buffer used during fragmented RTP packet processing. A remote, unauthenticated attacker can send a continuous stream of RTP fragments without ever transmitting an end-of-fragment marker, causing the reassembly buffer to grow without bound until process memory is exhausted. This results in a denial of service through process termination.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade gstreamer1-plugins-good-debuginfoUpgrade gstreamer1-plugins-good-gtkUpgrade gstreamer1-plugins-good-debugsourceUpgrade gstreamer1-plugins-good-gtk-debuginfoUpgrade gstreamer1-plugins-good | Sep 1, 2026 | Aug 6, 2026 |
| Freebsd | — | Upgrade gstreamer1-plugins-uglyUpgrade gstreamer1-plugins-badUpgrade gstreamer1-libavUpgrade gstreamer1-plugins-good | Aug 10, 2026 | Aug 8, 2026 |
| Redhat_linux | — | Upgrade gstreamer1-plugins-good-qt6-debuginfoUpgrade gstreamer1-plugins-goodUpgrade gstreamer1-plugins-good-gtk-debuginfoUpgrade gstreamer1-plugins-good-gtkUpgrade gstreamer1-plugins-good-debugsourceUpgrade gstreamer1-plugins-good-debuginfoUpgrade gstreamer1-plugins-good-qt-debuginfo | Aug 10, 2026 | Aug 6, 2026 |
| Rocky_linux | — | Upgrade gstreamer1-plugins-good-debugsourceUpgrade gstreamer1-plugins-good-debuginfoUpgrade gstreamer1-plugins-good-gtkUpgrade gstreamer1-plugins-goodUpgrade gstreamer1-plugins-good-gtk-debuginfo | Aug 13, 2026 | Aug 12, 2026 |
| Ubuntu | — | Upgrade gstreamer1.0-gtk3Upgrade gstreamer1.0-qt5Upgrade gstreamer1.0-qt5 (Ubuntu Pro)Upgrade libgstreamer-plugins-good1.0-0Upgrade gstreamer1.0-gtk3 (Ubuntu Pro)Upgrade gstreamer1.0-plugins-goodUpgrade gstreamer1.0-plugins-good (Ubuntu Pro)Upgrade gstreamer1.0-qt6Upgrade libgstreamer-plugins-good1.0-0 (Ubuntu Pro) | Sep 21, 2026 | Sep 17, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub