CVE-2026-85150

A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter's terminator can cause an internal length calculation to underflow, leading to a crash of the process parsing the header. On an RTSP server this can be triggered by a remote, unauthenticated attacker sending a single malformed request when the server has authentication enabled; the same flaw can also be triggered against an RTSP client by a malicious or compromised RTSP server. Successful exploitation results in a denial of service (application crash) and has no confirmed impact on confidentiality or integrity.

Analysis of which Red Hat products ship the affected gst-plugins-base RTSP library and/or gst-rtsp-server is still pending component mapping; this statement will be updated once that mapping is complete. The vulnerable code path is only reachable in gst-rtsp-server based RTSP servers when the application has explicitly configured a GstRTSPAuth object (Basic or Digest authentication enabled) -- gst_rtsp_auth_check() short-circuits and never calls the vulnerable parser when no auth object is configured, so RTSP servers/media servers run without authentication are not affected by the server-side attack path. RTSP client code (e.g. rtspsrc, rtspclientsink) that connects to an untrusted/attacker-controlled RTSP server and processes its WWW-Authenticate header is affected regardless of whether the local application itself configures authentication.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.