High [CVE-2026-59692] DTLS certificate Subject DN stack buffer overflow in openssl_verify_callback
This high-severity Red Hat Linux advisory covers CVE-2026-59692 affecting Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
A stack buffer overflow vulnerability was found in GStreamer's DTLS plugin. During a DTLS handshake, the peer certificate Subject Distinguished Name is printed into a fixed-size 2048-byte stack buffer without bounds checking.
A remote unauthenticated attacker can send a certificate with an oversized Subject DN that exceeds the buffer, causing a stack buffer overflow and process crash, resulting in denial of service. This vulnerability is rated as Important severity because it is remotely triggerable without authentication or user interaction during a DTLS handshake.
However, the actual impact is limited to denial of service. Remote code execution is not achievable because X509_NAME_print_ex() escapes all binary and control characters to printable ASCII sequences, preventing arbitrary byte injection into the overflow.
Combined with stack canary protection (-fstack-protector-strong) in Red Hat builds, return address corruption cannot be exploited. The DTLS plugin is shipped as part of gstreamer1-plugins-bad-free in Red Hat Enterprise Linux 8, 9, 10, and RHIVOS.
It is used by GStreamer WebRTC pipelines. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Weakness: CWE-121.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 9 days ago·verify at source
- gstreamer1-plugins-bad-free-0:1.26.7-2.el10_2.6
- gstreamer1-plugins-bad-free-0:1.24.11-3.el10_0.6
- gstreamer1-plugins-bad-free-0:1.10.4-7.el7_9
- gstreamer1-plugins-bad-free-0:1.16.1-9.el8_10.1
- gstreamer1-plugins-bad-free-0:1.16.1-4.el8_4.4
- gstreamer1-plugins-bad-free-0:1.16.1-4.el8_6.4
- gstreamer1-plugins-bad-free-0:1.16.1-4.el8_8.4
- gstreamer1-plugins-bad-free-0:1.22.12-7.el9_8.3
- gstreamer1-plugins-bad-free-0:1.18.4-9.el9_2.5
- gstreamer1-plugins-bad-free-0:1.22.1-6.el9_4.6
- gstreamer1-plugins-bad-free-0:1.22.12-5.el9_6.6
- RHSA-2026:47180
- RHSA-2026:54659
- RHSA-2026:54752
- RHSA-2026:47731
- RHSA-2026:56772
- RHSA-2026:54665
- RHSA-2026:54664
- RHSA-2026:47179
- RHSA-2026:56658
- RHSA-2026:54658
- RHSA-2026:54660
Official advisory · high-confidence parse· fetched 9 days ago·verify at source
Mitigation checklist
- There is no complete mitigation for this vulnerability. The following measures can reduce risk: 1. If WebRTC/DTLS functionality is not required, remove the DTLS plugin shared object from the GStreamer plugins directory (typically /usr/lib64/gstreamer-1.0/libgstdtls.so). 2. Restrict network access to WebRTC/DTLS endpoints to trusted peers only via firewall rules. 3. Deploy GStreamer WebRTC services behind a reverse proxy or media server that validates DTLS certificates before forwarding.
Official advisory · high-confidence parse· fetched 9 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.