High [CVE-2026-59692] DTLS certificate Subject DN stack buffer overflow in openssl_verify_callback
This high-severity Red Hat Linux advisory covers CVE-2026-59692 affecting Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Summary
A stack buffer overflow vulnerability was found in GStreamer's DTLS plugin. During a DTLS handshake, the peer certificate Subject Distinguished Name is printed into a fixed-size 2048-byte stack buffer without bounds checking.
A remote unauthenticated attacker can send a certificate with an oversized Subject DN that exceeds the buffer, causing a stack buffer overflow and process crash, resulting in denial of service. This vulnerability is rated as Important severity because it is remotely triggerable without authentication or user interaction during a DTLS handshake.
However, the actual impact is limited to denial of service. Remote code execution is not achievable because X509_NAME_print_ex() escapes all binary and control characters to printable ASCII sequences, preventing arbitrary byte injection into the overflow.
Combined with stack canary protection (-fstack-protector-strong) in Red Hat builds, return address corruption cannot be exploited. The DTLS plugin is shipped as part of gstreamer1-plugins-bad-free in Red Hat Enterprise Linux 8, 9, 10, and RHIVOS.
It is used by GStreamer WebRTC pipelines. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Weakness: CWE-121.
Is CVE-2026-59692 exploited?
No exploitation is reported in the sources VulniPulse tracks: CVE-2026-59692 is not in the CISA KEV catalog (checked ) and this advisory does not report exploitation. That is not proof the vulnerability cannot be exploited.
How do I fix CVE-2026-59692?
Upgrade to a fixed release named by Red Hat:
- gstreamer1-plugins-bad-free-0:1.26.7-2.el10_2.6
- gstreamer1-plugins-bad-free-0:1.24.11-3.el10_0.6
- gstreamer1-plugins-bad-free-0:1.10.4-7.el7_9
- gstreamer1-plugins-bad-free-0:1.16.1-9.el8_10.1
- gstreamer1-plugins-bad-free-0:1.16.1-4.el8_4.4
- gstreamer1-plugins-bad-free-0:1.16.1-4.el8_6.4
- gstreamer1-plugins-bad-free-0:1.16.1-4.el8_8.4
- gstreamer1-plugins-bad-free-0:1.22.12-7.el9_8.3
- gstreamer1-plugins-bad-free-0:1.18.4-9.el9_2.5
- gstreamer1-plugins-bad-free-0:1.22.1-6.el9_4.6
- gstreamer1-plugins-bad-free-0:1.22.12-5.el9_6.6
- RHSA-2026:47180
10 more fixed releases are listed below.
Confirm against the vendor advisory before you patch.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative. Check it before change work.
Official advisory · high-confidence parse· fetched 10 days ago·verify at source
- gstreamer1-plugins-bad-free-0:1.26.7-2.el10_2.6
- gstreamer1-plugins-bad-free-0:1.24.11-3.el10_0.6
- gstreamer1-plugins-bad-free-0:1.10.4-7.el7_9
- gstreamer1-plugins-bad-free-0:1.16.1-9.el8_10.1
- gstreamer1-plugins-bad-free-0:1.16.1-4.el8_4.4
- gstreamer1-plugins-bad-free-0:1.16.1-4.el8_6.4
- gstreamer1-plugins-bad-free-0:1.16.1-4.el8_8.4
- gstreamer1-plugins-bad-free-0:1.22.12-7.el9_8.3
- gstreamer1-plugins-bad-free-0:1.18.4-9.el9_2.5
- gstreamer1-plugins-bad-free-0:1.22.1-6.el9_4.6
- gstreamer1-plugins-bad-free-0:1.22.12-5.el9_6.6
- RHSA-2026:47180
- RHSA-2026:54659
- RHSA-2026:54752
- RHSA-2026:47731
- RHSA-2026:56772
- RHSA-2026:54665
- RHSA-2026:54664
- RHSA-2026:47179
- RHSA-2026:56658
- RHSA-2026:54658
- RHSA-2026:54660
Official advisory · high-confidence parse· fetched 10 days ago·verify at source
Mitigation checklist
- There is no complete mitigation for this vulnerability. The following measures can reduce risk: 1. If WebRTC/DTLS functionality is not required, remove the DTLS plugin shared object from the GStreamer plugins directory (typically /usr/lib64/gstreamer-1.0/libgstdtls.so). 2. Restrict network access to WebRTC/DTLS endpoints to trusted peers only via firewall rules. 3. Deploy GStreamer WebRTC services behind a reverse proxy or media server that validates DTLS certificates before forwarding.
Official advisory · high-confidence parse· fetched 10 days ago·verify at source
Get an email when Red Hat RHEL & SELinux publishes the next one.
See Red Hat RHEL & SELinux's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
More Red Hat Linux advisories
- CVE-2026-46300May 13, 2026"Fragnesia" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local
- CVE-2026-31431Apr 22, 2026algif_aead - Revert to operating out-of-place
- CVE-2026-34486Apr 9, 2026Missing Encryption of Sensitive Data due to EncryptInterceptor bypass
- CVE-2025-31277Mar 18, 2026Processing maliciously crafted web content may lead to memory corruption
- CVE-2026-53362Jul 4, 2026account for fraggap on the paged allocation path
- CVE-2026-119977Oct 31, 2026Arbitrary code execution via predictable upgrade staging paths
iPhone and Android apps · New on the App Store
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.