{"id":"CVE-2026-18649","state":"PUBLISHED","title":"Gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay rtp depayloaders","description":"A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on the reassembly buffer used during fragmented RTP packet processing. A remote, unauthenticated attacker can send a continuous stream of RTP fragments without ever transmitting an end-of-fragment marker, causing the reassembly buffer to grow without bound until process memory is exhausted. This results in a denial of service through process termination.","publishedAt":"2026-08-06T06:48:10.027Z","updatedAt":"2026-09-23T15:06:16.075Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"redhat"},"assigner":"redhat","products":["Red Hat Red Hat Enterprise Linux 10","Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support","Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support","Red Hat Red Hat Enterprise Linux 8","Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support","Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On","Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support","Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On","Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service","Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","Red Hat Red Hat Enterprise Linux 9","Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support"],"affected":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"gstreamer1-plugins-good","defaultStatus":"affected","versions":[{"version":"0:1.26.7-2.el10_2.3","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","packageName":"gstreamer1-plugins-good","defaultStatus":"affected","versions":[{"version":"0:1.24.11-1.el10_0.4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7 Extended Lifecycle Support","packageName":"gstreamer1-plugins-good","defaultStatus":"affected","versions":[{"version":"0:1.10.4-4.el7_9.3","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"gstreamer1-plugins-good","defaultStatus":"affected","versions":[{"version":"0:1.16.1-7.el8_10.3","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support","packageName":"gstreamer1-plugins-good","defaultStatus":"affected","versions":[{"version":"0:1.16.1-4.el8_4.2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.4::appstream","cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On","packageName":"gstreamer1-plugins-good","defaultStatus":"affected","versions":[{"version":"0:1.16.1-4.el8_4.2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.4::appstream","cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support","packageName":"gstreamer1-plugins-good","defaultStatus":"affected","versions":[{"version":"0:1.16.1-4.el8_6.3","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream","cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On","packageName":"gstreamer1-plugins-good","defaultStatus":"affected","versions":[{"version":"0:1.16.1-4.el8_6.3","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream","cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.8 Telecommunications Update Service","packageName":"gstreamer1-plugins-good","defaultStatus":"affected","versions":[{"version":"0:1.16.1-5.el8_8.3","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:8.8::appstream","cpe:/a:redhat:rhel_tus:8.8::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","packageName":"gstreamer1-plugins-good","defaultStatus":"affected","versions":[{"version":"0:1.16.1-5.el8_8.3","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:8.8::appstream","cpe:/a:redhat:rhel_tus:8.8::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"gstreamer1-plugins-good","defaultStatus":"affected","versions":[{"version":"0:1.22.12-7.el9_8.2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","packageName":"gstreamer1-plugins-good","defaultStatus":"affected","versions":[{"version":"0:1.18.4-8.el9_2.2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","packageName":"gstreamer1-plugins-good","defaultStatus":"affected","versions":[{"version":"0:1.22.1-4.el9_4.2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","packageName":"gstreamer1-plugins-good","defaultStatus":"affected","versions":[{"version":"0:1.22.12-5.el9_6.2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.6::appstream"]}],"references":["https://0xsemizzz.vercel.app/projects/cve-2026-18649-gstreamer-rtp-dos/","https://access.redhat.com/errata/RHSA-2026:53451","https://access.redhat.com/errata/RHSA-2026:53452","https://access.redhat.com/errata/RHSA-2026:56966","https://access.redhat.com/errata/RHSA-2026:61588","https://access.redhat.com/errata/RHSA-2026:61943","https://access.redhat.com/errata/RHSA-2026:65959","https://access.redhat.com/errata/RHSA-2026:65999","https://access.redhat.com/errata/RHSA-2026:69232","https://access.redhat.com/errata/RHSA-2026:70264","https://access.redhat.com/errata/RHSA-2026:70584","https://access.redhat.com/errata/RHSA-2026:70803","https://access.redhat.com/security/cve/CVE-2026-18649","https://bugzilla.redhat.com/show_bug.cgi?id=2510614","https://github.com/0xSemizzz/CVE-2026-18649","https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/merge_requests/113"],"weaknesses":["CWE-770"],"ingestedAt":"2026-10-29T20:11:10.572Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/18xxx/CVE-2026-18649.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-18649","state":"PUBLISHED","datePublished":"2026-08-06T06:48:10.027Z","dateUpdated":"2026-09-23T15:06:16.075Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2026-08-03T11:33:04.652Z"},"containers":{"cna":{"title":"Gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay rtp depayloaders","descriptions":[{"lang":"en","value":"A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on the reassembly buffer used during fragmented RTP packet processing. A remote, unauthenticated attacker can send a continuous stream of RTP fragments without ever transmitting an end-of-fragment marker, causing the reassembly buffer to grow without bound until process memory is exhausted. This results in a denial of service through process termination."}],"affected":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"gstreamer1-plugins-good","defaultStatus":"affected","versions":[{"version":"0:1.26.7-2.el10_2.3","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","packageName":"gstreamer1-plugins-good","defaultStatus":"affected","versions":[{"version":"0:1.24.11-1.el10_0.4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7 Extended Lifecycle Support","packageName":"gstreamer1-plugins-good","defaultStatus":"affected","versions":[{"version":"0:1.10.4-4.el7_9.3","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"gstreamer1-plugins-good","defaultStatus":"affected","versions":[{"version":"0:1.16.1-7.el8_10.3","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support","packageName":"gstreamer1-plugins-good","defaultStatus":"affected","versions":[{"version":"0:1.16.1-4.el8_4.2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.4::appstream","cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On","packageName":"gstreamer1-plugins-good","defaultStatus":"affected","versions":[{"version":"0:1.16.1-4.el8_4.2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.4::appstream","cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support","packageName":"gstreamer1-plugins-good","defaultStatus":"affected","versions":[{"version":"0:1.16.1-4.el8_6.3","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream","cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On","packageName":"gstreamer1-plugins-good","defaultStatus":"affected","versions":[{"version":"0:1.16.1-4.el8_6.3","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream","cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.8 Telecommunications Update Service","packageName":"gstreamer1-plugins-good","defaultStatus":"affected","versions":[{"version":"0:1.16.1-5.el8_8.3","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:8.8::appstream","cpe:/a:redhat:rhel_tus:8.8::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","packageName":"gstreamer1-plugins-good","defaultStatus":"affected","versions":[{"version":"0:1.16.1-5.el8_8.3","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:8.8::appstream","cpe:/a:redhat:rhel_tus:8.8::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"gstreamer1-plugins-good","defaultStatus":"affected","versions":[{"version":"0:1.22.12-7.el9_8.2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","packageName":"gstreamer1-plugins-good","defaultStatus":"affected","versions":[{"version":"0:1.18.4-8.el9_2.2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","packageName":"gstreamer1-plugins-good","defaultStatus":"affected","versions":[{"version":"0:1.22.1-4.el9_4.2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","packageName":"gstreamer1-plugins-good","defaultStatus":"affected","versions":[{"version":"0:1.22.12-5.el9_6.2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.6::appstream"]}],"references":[{"url":"https://0xsemizzz.vercel.app/projects/cve-2026-18649-gstreamer-rtp-dos/"},{"url":"https://access.redhat.com/errata/RHSA-2026:53451","name":"RHSA-2026:53451","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53452","name":"RHSA-2026:53452","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:56966","name":"RHSA-2026:56966","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61588","name":"RHSA-2026:61588","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61943","name":"RHSA-2026:61943","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:65959","name":"RHSA-2026:65959","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:65999","name":"RHSA-2026:65999","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:69232","name":"RHSA-2026:69232","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:70264","name":"RHSA-2026:70264","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:70584","name":"RHSA-2026:70584","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:70803","name":"RHSA-2026:70803","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-18649","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510614","name":"RHBZ#2510614","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://github.com/0xSemizzz/CVE-2026-18649"},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/merge_requests/113"}],"metrics":[{"other":{"content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-770","description":"Allocation of Resources Without Limits or Throttling","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-09-23T15:06:16.075Z"},"datePublic":"2026-08-06T06:41:36.036Z","x_redhatCweChain":"CWE-770: Allocation of Resources Without Limits or Throttling","workarounds":[{"lang":"en","value":"The following mitigations can reduce risk before a patch is available:\n\n1. Use SRTP or DTLS-SRTP: Deploy the srtpdec element in the pipeline before the depayloader. SRTP provides per-packet authentication and will reject unauthenticated fragments before they reach rtph264depay/rtph265depay, completely preventing exploitation.\n\n2. Network-level restriction: Use firewall rules (iptables/nftables) to restrict which sources can send RTP traffic to the GStreamer process. Allow RTP only from trusted, authenticated peers.\n\n3. Build-time exclusion: Disable the entire RTP plugin by configuring with \"-Drtp=disabled\" in meson build options. This removes all RTP functionality including the vulnerable depayloaders.\n\n4. Runtime element exclusion: Prevent the affected elements from being auto-plugged by setting GST_PLUGIN_FEATURE_RANK=rtph264depay:0,rtph265depay:0. This prevents automatic selection but not explicit pipeline construction."}],"timeline":[{"lang":"en","time":"2026-07-31T15:39:42.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-08-06T06:41:36.036Z","value":"Made public."}],"credits":[{"lang":"en","value":"Red Hat would like to thank Yehia Ali Mohamed Ezzat (github: 0xSemizzz) for reporting this issue."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-06T13:42:01.159055Z","id":"CVE-2026-18649","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-06T13:42:09.027Z"}}]}}}