CVE-2026-85150
massNULL pointer dereference DoS in GStreamer RTSP Digest authentication
CVE-2026-85150 is a NULL pointer dereference (CWE-476) in GStreamer's RTSP support library, triggered while parsing Authorization or WWW-Authenticate headers that use Digest authentication. Specially crafted whitespace placement around a parameter's terminator causes an internal length calculation to underflow, crashing the process parsing the header. A remote, unauthenticated attacker can crash an RTSP server that has authentication enabled with a single malformed request, and a malicious or compromised RTSP server can crash GStreamer-based RTSP clients; the impact is denial of service only, with no confirmed confidentiality or integrity impact. Any deployment using GStreamer's RTSP components is plausibly affected, though specific vulnerable version ranges were not provided in the available data. Exploitation has not been observed: there is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only about a 0.5% probability of exploitation within 30 days.
What to do: Apply patched GStreamer packages from your vendor or Linux distribution as soon as they are available, since no fixed version numbers were included in the available data. As interim mitigation, disable Digest authentication on exposed GStreamer-based RTSP servers or restrict RTSP (e.g., TCP 554) access to trusted networks, and inventory deployments that run gst-rtsp-server or GStreamer-based RTSP clients connecting to untrusted servers.
| GStreamer RTSP support library (Digest authentication header parsing, affecting both RTSP server and RTSP client paths) | — |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter's terminator can cause an internal length calculation to underflow, leading to a crash of the process parsing the header. On an RTSP server this can be triggered by a remote, unauthenticated attacker sending a single malformed request when the server has authentication enabled; the same flaw can also be triggered against an RTSP client by a malicious or compromised RTSP server. Successful exploitation results in a denial of service (application crash) and has no confirmed impact on confidentiality or integrity.
- Weakness
- CWE-476
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
In the news0 stories
No ingested article mentions this CVE yet.