CVE-2026-18649
Received Received - Intake

GStreamer gst-plugins-good RTP Fragmentation DoS

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: Red Hat, Inc.

Description
A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on the reassembly buffer used during fragmented RTP packet processing. A remote, unauthenticated attacker can send a continuous stream of RTP fragments without ever transmitting an end-of-fragment marker, causing the reassembly buffer to grow without bound until process memory is exhausted. This results in a denial of service through process termination.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2026-18649
EUVD
EUVD-2026-53768

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
gstreamer gst-plugins-good 1.28.2
gstreamer gst-plugins-good 1.28.5
gstreamer gst-plugins-good 1.28.6
gstreamer gst-plugins-good 1.28.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a denial-of-service flaw in GStreamer's gst-plugins-good package. The rtph264depay and rtph265depay elements fail to limit the size of a reassembly buffer when processing fragmented RTP packets. An attacker can send endless RTP fragments without an end marker, causing the buffer to grow until the process crashes from memory exhaustion.

Detection Guidance

Monitor for abnormal memory usage in GStreamer processes handling RTP streams. Check for continuous RTP fragment streams without end markers using network tools like tcpdump or Wireshark to inspect RTP traffic for fragmented payloads. Look for processes named rtph264depay or rtph265depay consuming excessive memory.

Impact Analysis

If you use GStreamer pipelines that process unauthenticated RTP over UDP (e.g., udpsrc feeding rtph264depay), an attacker could crash your application or system by sending specially crafted RTP fragments. Services relying on raw RTP without SRTP/DTLS-SRTP protection are at risk.

Mitigation Strategies

Use SRTP or DTLS-SRTP to authenticate RTP packets before processing. Apply firewall rules to restrict RTP traffic sources. Disable the RTP plugin at build time or prevent vulnerable elements from auto-plugging at runtime. Update to patched GStreamer versions once available (1.28.6 or later).

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18649. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart