p PatchFirst

CVE-2026-107696

CVE-2026-107696 · FFmpeg through 9.0.2 Infinite Loop via RTSP Redirect Handling in rtsp.c

This page contains facts from public vulnerability sources. Check the original advisory before updating.

FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core.

CVSS 7.1 · High · EPSS 0.4%

Published
Updated

Stack: system

Affected products and versions

  • ffmpeg

    Versions
    • ≥ 0, ≤ 9.0.2: Affected (semver)

    No fix published

  • ffmpeg Debian:12

    Versions
    • 7:5.1.3-1
    • 7:5.1.3-2
    • 7:5.1.4-0+deb12u1
    • 7:5.1.5-0+deb12u1
    • 7:5.1.6-0+deb12u1
    • 7:5.1.7-0+deb12u1
    • 7:5.1.8-0+deb12u1
    • 7:5.1.9-0+deb12u1
    • 7:6.0-1
    • 7:6.0-2
    • 7:6.0-3
    • 7:6.0-4
    • 7:6.0-5
    • 7:6.0-6
    • 7:6.0-7
    • 7:6.0-8
    • 7:6.0-9
    • 7:6.1-1
    • 7:6.1-2
    • 7:6.1-3
    • 7:6.1-4
    • 7:6.1-5
    • 7:6.1.1-1
    • 7:6.1.1-2
    • 7:6.1.1-3
    • 7:6.1.1-4
    • 7:6.1.1-5
    • 7:7.0-1
    • 7:7.0.1-1
    • 7:7.0.1-2
    • 7:7.0.1-3
    • 7:7.0.1-4
    • 7:7.0.1-5
    • 7:7.0.2-1
    • 7:7.0.2-2
    • 7:7.0.2-3
    • 7:7.1-1
    • 7:7.1-2
    • 7:7.1-3
    • 7:7.1-4
    • 7:7.1.1-1
    • 7:7.1.2-1
    • 7:7.1.3-1
    • 7:8.0-1
    • 7:8.0-2
    • 7:8.0.1-1
    • 7:8.0.1-2
    • 7:8.0.1-3
    • 7:8.1-1
    • 7:8.1-2
    • 7:8.1-3
    • 7:8.1.1-1
    • 7:8.1.1-2
    • 7:8.1.1-3
    • 7:8.1.1-4
    • 7:8.1.2-1
    • 7:8.1.2-2
    • 7:9.0-1
    • 7:9.0.1-1
    • 7:9.0.2-1
    • 7:9.0.2-2
    • 7:9.0.2-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ffmpeg Debian:13

    Versions
    • 7:7.1.1-1
    • 7:7.1.2-0+deb13u1
    • 7:7.1.2-1
    • 7:7.1.3-0+deb13u1
    • 7:7.1.3-1
    • 7:7.1.4-0+deb13u1
    • 7:7.1.5-0+deb13u1
    • 7:8.0-1
    • 7:8.0-2
    • 7:8.0.1-1
    • 7:8.0.1-2
    • 7:8.0.1-3
    • 7:8.1-1
    • 7:8.1-2
    • 7:8.1-3
    • 7:8.1.1-1
    • 7:8.1.1-2
    • 7:8.1.1-3
    • 7:8.1.1-4
    • 7:8.1.2-1
    • 7:8.1.2-2
    • 7:9.0-1
    • 7:9.0.1-1
    • 7:9.0.2-1
    • 7:9.0.2-2
    • 7:9.0.2-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ffmpeg Debian:14

    Versions
    • 7:7.1.1-1
    • 7:7.1.2-1
    • 7:7.1.3-1
    • 7:8.0-1
    • 7:8.0-2
    • 7:8.0.1-1
    • 7:8.0.1-2
    • 7:8.0.1-3
    • 7:8.1-1
    • 7:8.1-2
    • 7:8.1-3
    • 7:8.1.1-1
    • 7:8.1.1-2
    • 7:8.1.1-3
    • 7:8.1.1-4
    • 7:8.1.2-1
    • 7:8.1.2-2
    • 7:9.0-1
    • 7:9.0.1-1
    • 7:9.0.2-1
    • 7:9.0.2-2
    • 7:9.0.2-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libav Ubuntu:Pro:14.04:LTS

    Versions
    • 6:0.8.7-1ubuntu2
    • 6:9.10-1ubuntu1
    • 6:9.10-1ubuntu2
    • 6:9.10-1ubuntu5
    • 6:9.10-1ubuntu6
    • 6:9.10-1ubuntu7
    • 6:9.11-2ubuntu1
    • 6:9.11-2ubuntu2
    • 6:9.13-0ubuntu0.14.04.1
    • 6:9.14-0ubuntu0.14.04.1
    • 6:9.16-0ubuntu0.14.04.1
    • 6:9.18-0ubuntu0.14.04.1
    • 6:9.20-0ubuntu0.14.04.1
    • 6:9.20-0ubuntu0.14.04.1+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ffmpeg Ubuntu:Pro:16.04:LTS

    Versions
    • 7:2.7.2-1build1
    • 7:2.8.1-1ubuntu1
    • 7:2.8.2-1ubuntu1
    • 7:2.8.3-1
    • 7:2.8.4-1
    • 7:2.8.4-1ubuntu1
    • 7:2.8.4-1ubuntu2
    • 7:2.8.4-1ubuntu3
    • 7:2.8.4-1ubuntu4
    • 7:2.8.6-1ubuntu1
    • 7:2.8.6-1ubuntu2
    • 7:2.8.8-0ubuntu0.16.04.1
    • 7:2.8.10-0ubuntu0.16.04.1
    • 7:2.8.11-0ubuntu0.16.04.1
    • 7:2.8.14-0ubuntu0.16.04.1
    • 7:2.8.15-0ubuntu0.16.04.1
    • 7:2.8.15-0ubuntu0.16.04.1+esm1
    • 7:2.8.17-0ubuntu0.1
    • 7:2.8.17-0ubuntu0.1+esm1
    • 7:2.8.17-0ubuntu0.1+esm2
    • 7:2.8.17-0ubuntu0.1+esm3
    • 7:2.8.17-0ubuntu0.1+esm4
    • 7:2.8.17-0ubuntu0.1+esm5
    • 7:2.8.17-0ubuntu0.1+esm6
    • 7:2.8.17-0ubuntu0.1+esm7
    • 7:2.8.17-0ubuntu0.1+esm8
    • 7:2.8.17-0ubuntu0.1+esm9
    • 7:2.8.17-0ubuntu0.1+esm10
    • 7:2.8.17-0ubuntu0.1+esm11
    • 7:2.8.17-0ubuntu0.1+esm12
    • 7:2.8.17-0ubuntu0.1+esm13
    • 7:2.8.17-0ubuntu0.1+esm14
    • 7:2.8.17-0ubuntu0.1+esm15
    • 7:2.8.17-0ubuntu0.1+esm16
    • 7:2.8.17-0ubuntu0.1+esm17
    • 7:2.8.17-0ubuntu0.1+esm18
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ffmpeg Ubuntu:Pro:18.04:LTS

    Versions
    • 7:3.3.4-2
    • 7:3.3.4-2build3
    • 7:3.4-2ubuntu2
    • 7:3.4-4
    • 7:3.4-4build1
    • 7:3.4.1-1
    • 7:3.4.1-1build1
    • 7:3.4.2-1
    • 7:3.4.2-1build1
    • 7:3.4.2-2
    • 7:3.4.4-0ubuntu0.18.04.1
    • 7:3.4.6-0ubuntu0.18.04.1
    • 7:3.4.8-0ubuntu0.2
    • 7:3.4.11-0ubuntu0.1
    • 7:3.4.11-0ubuntu0.1+esm1
    • 7:3.4.11-0ubuntu0.1+esm2
    • 7:3.4.11-0ubuntu0.1+esm3
    • 7:3.4.11-0ubuntu0.1+esm4
    • 7:3.4.11-0ubuntu0.1+esm5
    • 7:3.4.11-0ubuntu0.1+esm6
    • 7:3.4.11-0ubuntu0.1+esm7
    • 7:3.4.11-0ubuntu0.1+esm8
    • 7:3.4.11-0ubuntu0.1+esm9
    • 7:3.4.11-0ubuntu0.1+esm10
    • 7:3.4.11-0ubuntu0.1+esm11
    • 7:3.4.11-0ubuntu0.1+esm12
    • 7:3.4.11-0ubuntu0.1+esm13
    • 7:3.4.11-0ubuntu0.1+esm14
    • 7:3.4.11-0ubuntu0.1+esm15
    • 7:3.4.11-0ubuntu0.1+esm16
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ffmpeg Ubuntu:Pro:20.04:LTS

    Versions
    • 7:4.1.4-1build2
    • 7:4.2.1-2
    • 7:4.2.1-2ubuntu1
    • 7:4.2.2-1build1
    • 7:4.2.2-1ubuntu1
    • 7:4.2.4-1ubuntu0.1
    • 7:4.2.4-1ubuntu0.1+esm1
    • 7:4.2.7-0ubuntu0.1
    • 7:4.2.7-0ubuntu0.1+esm1
    • 7:4.2.7-0ubuntu0.1+esm2
    • 7:4.2.7-0ubuntu0.1+esm3
    • 7:4.2.7-0ubuntu0.1+esm4
    • 7:4.2.7-0ubuntu0.1+esm5
    • 7:4.2.7-0ubuntu0.1+esm6
    • 7:4.2.7-0ubuntu0.1+esm7
    • 7:4.2.7-0ubuntu0.1+esm8
    • 7:4.2.7-0ubuntu0.1+esm9
    • 7:4.2.7-0ubuntu0.1+esm10
    • 7:4.2.7-0ubuntu0.1+esm11
    • 7:4.2.7-0ubuntu0.1+esm12
    • 7:4.2.7-0ubuntu0.1+esm13
    • 7:4.2.7-0ubuntu0.1+esm14
    • 7:4.2.7-0ubuntu0.1+esm15
    • 7:4.2.7-0ubuntu0.1+esm16
    • 7:4.2.7-0ubuntu0.1+esm17
    • 7:4.2.7-0ubuntu0.1+esm18
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ffmpeg Ubuntu:Pro:22.04:LTS

    Versions
    • 7:4.4-6ubuntu5
    • 7:4.4.1-2ubuntu1
    • 7:4.4.1-3ubuntu1
    • 7:4.4.1-3ubuntu2
    • 7:4.4.1-3ubuntu3
    • 7:4.4.1-3ubuntu5
    • 7:4.4.2-0ubuntu0.22.04.1
    • 7:4.4.2-0ubuntu0.22.04.1+esm1
    • 7:4.4.2-0ubuntu0.22.04.1+esm2
    • 7:4.4.2-0ubuntu0.22.04.1+esm3
    • 7:4.4.2-0ubuntu0.22.04.1+esm4
    • 7:4.4.2-0ubuntu0.22.04.1+esm5
    • 7:4.4.2-0ubuntu0.22.04.1+esm6
    • 7:4.4.2-0ubuntu0.22.04.1+esm7
    • 7:4.4.2-0ubuntu0.22.04.1+esm8
    • 7:4.4.2-0ubuntu0.22.04.1+esm9
    • 7:4.4.2-0ubuntu0.22.04.1+esm10
    • 7:4.4.2-0ubuntu0.22.04.1+esm11
    • 7:4.4.2-0ubuntu0.22.04.1+esm12
    • 7:4.4.2-0ubuntu0.22.04.1+esm13
    • 7:4.4.2-0ubuntu0.22.04.1+esm14
    • 7:4.4.2-0ubuntu0.22.04.1+esm15
    • 7:4.4.2-0ubuntu0.22.04.1+esm16
    • 7:4.4.2-0ubuntu0.22.04.1+esm17
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ffmpeg Ubuntu:Pro:24.04:LTS

    Versions
    • 7:6.0-6ubuntu1
    • 7:6.0-9ubuntu1
    • 7:6.1-2ubuntu1
    • 7:6.1-3ubuntu1
    • 7:6.1-4ubuntu1
    • 7:6.1-5ubuntu1
    • 7:6.1.1-1ubuntu1
    • 7:6.1.1-3ubuntu1
    • 7:6.1.1-3ubuntu5
    • 7:6.1.1-3ubuntu5+esm1
    • 7:6.1.1-3ubuntu5+esm2
    • 7:6.1.1-3ubuntu5+esm3
    • 7:6.1.1-3ubuntu5+esm4
    • 7:6.1.1-3ubuntu5+esm5
    • 7:6.1.1-3ubuntu5+esm6
    • 7:6.1.1-3ubuntu5+esm7
    • 7:6.1.1-3ubuntu5+esm8
    • 7:6.1.1-3ubuntu5+esm10
    • 7:6.1.1-3ubuntu5+esm11
    • 7:6.1.1-3ubuntu5+esm12
    • 7:6.1.1-3ubuntu5+esm13
    • 7:6.1.1-3ubuntu5+esm15
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ffmpeg Ubuntu:26.10

    Versions
    • 7:8.0.1-3ubuntu2
    • 7:8.1-3ubuntu3
    • 7:8.1.2-2ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ffmpeg Ubuntu:Pro:26.04:LTS

    Versions
    • 7:7.1.1-1ubuntu4
    • 7:7.1.2-1ubuntu3
    • 7:7.1.2-1ubuntu4
    • 7:7.1.3-1ubuntu1
    • 7:8.0.1-2ubuntu1
    • 7:8.0.1-3ubuntu1
    • 7:8.0.1-3ubuntu2
    • 7:8.0.1-3ubuntu2+esm1
    • 7:8.0.1-3ubuntu2+esm3
    • 7:8.0.1-3ubuntu2+esm4
    • 7:8.0.1-3ubuntu2+esm5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →