p PatchFirst

CVE-2026-107698

CVE-2026-107698 · FFmpeg before 7.1.4 and 8.0.2 SSRF via RTSP Redirect Handling

This page contains facts from public vulnerability sources. Check the original advisory before updating.

FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes, bypassing -protocol_whitelist, to probe internal network services.

CVSS 5.3 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • ffmpeg

    Versions
    • ≥ 0, < 7.1.4: Affected (semver)
    • ≥ 8.0, < 8.0.2: Affected (custom)

    Update to 7.1.4; Update to 8.0.2

  • ffmpeg Debian:12

    Versions
    • 7:5.1.3-1
    • 7:5.1.3-2
    • 7:5.1.4-0+deb12u1
    • 7:5.1.5-0+deb12u1
    • 7:5.1.6-0+deb12u1
    • 7:5.1.7-0+deb12u1
    • 7:5.1.8-0+deb12u1
    Affected ranges
    • ECOSYSTEM: < 7:5.1.9-0+deb12u1

    Update to 7:5.1.9-0+deb12u1

  • ffmpeg Debian:13

    Versions
    • 7:7.1.1-1
    • 7:7.1.2-0+deb13u1
    • 7:7.1.2-1
    • 7:7.1.3-0+deb13u1
    • 7:7.1.3-1
    • 7:7.1.4-0+deb13u1
    Affected ranges
    • ECOSYSTEM: < 7:7.1.5-0+deb13u1

    Update to 7:7.1.5-0+deb13u1

  • ffmpeg Debian:14

    Versions
    • 7:7.1.1-1
    • 7:7.1.2-1
    • 7:7.1.3-1
    • 7:8.0-1
    • 7:8.0-2
    • 7:8.0.1-1
    • 7:8.0.1-2
    • 7:8.0.1-3
    Affected ranges
    • ECOSYSTEM: < 7:8.1-1

    Update to 7:8.1-1

  • libav Ubuntu:Pro:14.04:LTS

    Versions
    • 6:0.8.7-1ubuntu2
    • 6:9.10-1ubuntu1
    • 6:9.10-1ubuntu2
    • 6:9.10-1ubuntu5
    • 6:9.10-1ubuntu6
    • 6:9.10-1ubuntu7
    • 6:9.11-2ubuntu1
    • 6:9.11-2ubuntu2
    • 6:9.13-0ubuntu0.14.04.1
    • 6:9.14-0ubuntu0.14.04.1
    • 6:9.16-0ubuntu0.14.04.1
    • 6:9.18-0ubuntu0.14.04.1
    • 6:9.20-0ubuntu0.14.04.1
    • 6:9.20-0ubuntu0.14.04.1+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ffmpeg Ubuntu:Pro:16.04:LTS

    Versions
    • 7:2.7.2-1build1
    • 7:2.8.1-1ubuntu1
    • 7:2.8.2-1ubuntu1
    • 7:2.8.3-1
    • 7:2.8.4-1
    • 7:2.8.4-1ubuntu1
    • 7:2.8.4-1ubuntu2
    • 7:2.8.4-1ubuntu3
    • 7:2.8.4-1ubuntu4
    • 7:2.8.6-1ubuntu1
    • 7:2.8.6-1ubuntu2
    • 7:2.8.8-0ubuntu0.16.04.1
    • 7:2.8.10-0ubuntu0.16.04.1
    • 7:2.8.11-0ubuntu0.16.04.1
    • 7:2.8.14-0ubuntu0.16.04.1
    • 7:2.8.15-0ubuntu0.16.04.1
    • 7:2.8.15-0ubuntu0.16.04.1+esm1
    • 7:2.8.17-0ubuntu0.1
    • 7:2.8.17-0ubuntu0.1+esm1
    • 7:2.8.17-0ubuntu0.1+esm2
    • 7:2.8.17-0ubuntu0.1+esm3
    • 7:2.8.17-0ubuntu0.1+esm4
    • 7:2.8.17-0ubuntu0.1+esm5
    • 7:2.8.17-0ubuntu0.1+esm6
    • 7:2.8.17-0ubuntu0.1+esm7
    • 7:2.8.17-0ubuntu0.1+esm8
    • 7:2.8.17-0ubuntu0.1+esm9
    • 7:2.8.17-0ubuntu0.1+esm10
    • 7:2.8.17-0ubuntu0.1+esm11
    • 7:2.8.17-0ubuntu0.1+esm12
    • 7:2.8.17-0ubuntu0.1+esm13
    • 7:2.8.17-0ubuntu0.1+esm14
    • 7:2.8.17-0ubuntu0.1+esm15
    • 7:2.8.17-0ubuntu0.1+esm16
    • 7:2.8.17-0ubuntu0.1+esm17
    • 7:2.8.17-0ubuntu0.1+esm18
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ffmpeg Ubuntu:Pro:18.04:LTS

    Versions
    • 7:3.3.4-2
    • 7:3.3.4-2build3
    • 7:3.4-2ubuntu2
    • 7:3.4-4
    • 7:3.4-4build1
    • 7:3.4.1-1
    • 7:3.4.1-1build1
    • 7:3.4.2-1
    • 7:3.4.2-1build1
    • 7:3.4.2-2
    • 7:3.4.4-0ubuntu0.18.04.1
    • 7:3.4.6-0ubuntu0.18.04.1
    • 7:3.4.8-0ubuntu0.2
    • 7:3.4.11-0ubuntu0.1
    • 7:3.4.11-0ubuntu0.1+esm1
    • 7:3.4.11-0ubuntu0.1+esm2
    • 7:3.4.11-0ubuntu0.1+esm3
    • 7:3.4.11-0ubuntu0.1+esm4
    • 7:3.4.11-0ubuntu0.1+esm5
    • 7:3.4.11-0ubuntu0.1+esm6
    • 7:3.4.11-0ubuntu0.1+esm7
    • 7:3.4.11-0ubuntu0.1+esm8
    • 7:3.4.11-0ubuntu0.1+esm9
    • 7:3.4.11-0ubuntu0.1+esm10
    • 7:3.4.11-0ubuntu0.1+esm11
    • 7:3.4.11-0ubuntu0.1+esm12
    • 7:3.4.11-0ubuntu0.1+esm13
    • 7:3.4.11-0ubuntu0.1+esm14
    • 7:3.4.11-0ubuntu0.1+esm15
    • 7:3.4.11-0ubuntu0.1+esm16
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ffmpeg Ubuntu:Pro:20.04:LTS

    Versions
    • 7:4.1.4-1build2
    • 7:4.2.1-2
    • 7:4.2.1-2ubuntu1
    • 7:4.2.2-1build1
    • 7:4.2.2-1ubuntu1
    • 7:4.2.4-1ubuntu0.1
    • 7:4.2.4-1ubuntu0.1+esm1
    • 7:4.2.7-0ubuntu0.1
    • 7:4.2.7-0ubuntu0.1+esm1
    • 7:4.2.7-0ubuntu0.1+esm2
    • 7:4.2.7-0ubuntu0.1+esm3
    • 7:4.2.7-0ubuntu0.1+esm4
    • 7:4.2.7-0ubuntu0.1+esm5
    • 7:4.2.7-0ubuntu0.1+esm6
    • 7:4.2.7-0ubuntu0.1+esm7
    • 7:4.2.7-0ubuntu0.1+esm8
    • 7:4.2.7-0ubuntu0.1+esm9
    • 7:4.2.7-0ubuntu0.1+esm10
    • 7:4.2.7-0ubuntu0.1+esm11
    • 7:4.2.7-0ubuntu0.1+esm12
    • 7:4.2.7-0ubuntu0.1+esm13
    • 7:4.2.7-0ubuntu0.1+esm14
    • 7:4.2.7-0ubuntu0.1+esm15
    • 7:4.2.7-0ubuntu0.1+esm16
    • 7:4.2.7-0ubuntu0.1+esm17
    • 7:4.2.7-0ubuntu0.1+esm18
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ffmpeg Ubuntu:Pro:22.04:LTS

    Versions
    • 7:4.4-6ubuntu5
    • 7:4.4.1-2ubuntu1
    • 7:4.4.1-3ubuntu1
    • 7:4.4.1-3ubuntu2
    • 7:4.4.1-3ubuntu3
    • 7:4.4.1-3ubuntu5
    • 7:4.4.2-0ubuntu0.22.04.1
    • 7:4.4.2-0ubuntu0.22.04.1+esm1
    • 7:4.4.2-0ubuntu0.22.04.1+esm2
    • 7:4.4.2-0ubuntu0.22.04.1+esm3
    • 7:4.4.2-0ubuntu0.22.04.1+esm4
    • 7:4.4.2-0ubuntu0.22.04.1+esm5
    • 7:4.4.2-0ubuntu0.22.04.1+esm6
    • 7:4.4.2-0ubuntu0.22.04.1+esm7
    • 7:4.4.2-0ubuntu0.22.04.1+esm8
    • 7:4.4.2-0ubuntu0.22.04.1+esm9
    • 7:4.4.2-0ubuntu0.22.04.1+esm10
    • 7:4.4.2-0ubuntu0.22.04.1+esm11
    • 7:4.4.2-0ubuntu0.22.04.1+esm12
    • 7:4.4.2-0ubuntu0.22.04.1+esm13
    • 7:4.4.2-0ubuntu0.22.04.1+esm14
    • 7:4.4.2-0ubuntu0.22.04.1+esm15
    • 7:4.4.2-0ubuntu0.22.04.1+esm16
    • 7:4.4.2-0ubuntu0.22.04.1+esm17
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ffmpeg Ubuntu:Pro:24.04:LTS

    Versions
    • 7:6.0-6ubuntu1
    • 7:6.0-9ubuntu1
    • 7:6.1-2ubuntu1
    • 7:6.1-3ubuntu1
    • 7:6.1-4ubuntu1
    • 7:6.1-5ubuntu1
    • 7:6.1.1-1ubuntu1
    • 7:6.1.1-3ubuntu1
    • 7:6.1.1-3ubuntu5
    • 7:6.1.1-3ubuntu5+esm1
    • 7:6.1.1-3ubuntu5+esm2
    • 7:6.1.1-3ubuntu5+esm3
    • 7:6.1.1-3ubuntu5+esm4
    • 7:6.1.1-3ubuntu5+esm5
    • 7:6.1.1-3ubuntu5+esm6
    • 7:6.1.1-3ubuntu5+esm7
    • 7:6.1.1-3ubuntu5+esm8
    • 7:6.1.1-3ubuntu5+esm10
    • 7:6.1.1-3ubuntu5+esm11
    • 7:6.1.1-3ubuntu5+esm12
    • 7:6.1.1-3ubuntu5+esm13
    • 7:6.1.1-3ubuntu5+esm15
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ffmpeg Ubuntu:26.10

    Versions
    • 7:8.0.1-3ubuntu2
    • 7:8.1-3ubuntu3
    • 7:8.1.2-2ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ffmpeg Ubuntu:Pro:26.04:LTS

    Versions
    • 7:7.1.1-1ubuntu4
    • 7:7.1.2-1ubuntu3
    • 7:7.1.2-1ubuntu4
    • 7:7.1.3-1ubuntu1
    • 7:8.0.1-2ubuntu1
    • 7:8.0.1-3ubuntu1
    • 7:8.0.1-3ubuntu2
    • 7:8.0.1-3ubuntu2+esm1
    • 7:8.0.1-3ubuntu2+esm3
    • 7:8.0.1-3ubuntu2+esm4
    • 7:8.0.1-3ubuntu2+esm5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →