High [CVE-2026-85150] Gstreamer1-plugins-base: gstreamer: null/invalid-pointer dereference in gst_rtsp_message_parse_auth_credentials when parsing a crafted digest authorization/www-authenticate header
This high-severity Red Hat Linux advisory covers CVE-2026-85150 affecting Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication.
Specially crafted whitespace placement around a parameter's terminator can cause an internal length calculation to underflow, leading to a crash of the process parsing the header.
On an RTSP server this can be triggered by a remote, unauthenticated attacker sending a single malformed request when the server has authentication enabled; the same flaw can also be triggered against an RTSP client by a malicious or compromised RTSP server.
Successful exploitation results in a denial of service (application crash) and has no confirmed impact on confidentiality or integrity. Analysis of which Red Hat products ship the affected gst-plugins-base RTSP library and/or gst-rtsp-server is still pending component mapping; this statement will be updated once that mapping is complete.
The vulnerable code path is only reachable in gst-rtsp-server based RTSP servers when the application has explicitly configured a GstRTSPAuth object (Basic or Digest authentication enabled) -- gst_rtsp_auth_check() short-circuits and never calls the vulnerable parser when no auth object is configured, so RTSP servers/media servers run without authentication are not affected by the server-side attack path.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Mitigation checklist
- No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.