CVE-2026-18649: GStreamer gst-plugins-good DoS Vulnerability

CVE-2026-18649 Overview

A flaw exists in the GStreamer gst-plugins-good package affecting the rtph264depay and rtph265depay RTP depayloader elements. These components fail to enforce a maximum size limit on the reassembly buffer used during fragmented RTP packet processing. A remote, unauthenticated attacker can send a continuous stream of RTP fragments without transmitting an end-of-fragment marker. The reassembly buffer grows without bound until process memory is exhausted, resulting in denial of service through process termination. The vulnerability is classified under [CWE-770] (Allocation of Resources Without Limits or Throttling).

Critical Impact
Remote, unauthenticated attackers can terminate GStreamer-based media processing services by exhausting process memory through unbounded RTP fragment streams.

Affected Products

GStreamer gst-plugins-good package
rtph264depay RTP depayloader element (H.264)
rtph265depay RTP depayloader element (H.265/HEVC)

Discovery Timeline

2026-08-06 - CVE CVE-2026-18649 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-18649

Vulnerability Analysis

GStreamer is a widely deployed multimedia framework used across Linux desktops, streaming servers, video conferencing tools, and embedded devices. The gst-plugins-good package contains the rtph264depay and rtph265depay elements. These elements reassemble fragmented Real-time Transport Protocol (RTP) packets into complete H.264 and H.265 Network Abstraction Layer (NAL) units.

RTP fragmentation splits large media payloads across multiple packets. The receiver accumulates fragments in a reassembly buffer until it observes an end-of-fragment marker. Only then does the depayloader deliver the reconstructed unit and clear the buffer.

The affected depayloaders never enforce an upper bound on this buffer. An attacker can transmit fragments continuously and omit the terminating marker. The buffer expands until the process exhausts available memory and terminates.

Root Cause

The root cause is missing resource throttling in the fragment reassembly logic. The depayloader accepts fragments and appends them to the reassembly buffer without validating cumulative size against a configurable ceiling. This maps directly to [CWE-770], allocation of resources without limits.

Attack Vector

Exploitation requires only network reachability to a GStreamer pipeline consuming RTP streams. No authentication or user interaction is required. An attacker crafts a stream of RTP packets containing H.264 or H.265 fragmentation unit (FU-A/FU) headers with the start bit set on the first fragment and the end bit never set. Successful exploitation crashes the media application, disrupting streaming, conferencing, or surveillance services. Refer to the GStreamer Security Merge Request for the upstream fix details.

Detection Methods for CVE-2026-18649

Indicators of Compromise

Sustained memory growth in gst-launch, gstreamer, or applications linking libgstrtp without corresponding output frame delivery.
Process termination logs (OOM killer entries in dmesg or journalctl) for GStreamer-based services processing RTP streams.
Inbound RTP flows with H.264/H.265 FU headers where the end bit is never observed across large fragment counts.

Detection Strategies

Monitor resident set size (RSS) growth of GStreamer pipeline processes and alert on unbounded increases tied to active RTP sessions.
Deploy network monitoring on RTP payload types to detect abnormal fragment-to-complete-NAL-unit ratios.
Correlate media service crashes with preceding inbound UDP traffic patterns to identify targeted exploitation.

Monitoring Recommendations

Enable process resource limits (RLIMIT_AS, RLIMIT_DATA) and alert on limit breaches for media services.
Log RTP session statistics from GStreamer pipelines and flag sessions producing no output frames despite sustained ingress.
Track OOM-killer events on hosts running GStreamer workloads and route them into centralized logging for correlation.

How to Mitigate CVE-2026-18649

Immediate Actions Required

Update gst-plugins-good to the fixed version distributed by your operating system vendor once available. Review the Red Hat CVE-2026-18649 Advisory for distribution-specific packages.
Restrict network exposure of RTP listeners to trusted sources using firewall rules or VPN-only access.
Apply cgroup memory limits to GStreamer processes so a crash does not affect co-located services.

Patch Information

The upstream fix is tracked in the GStreamer Security Merge Request. Distribution updates are being coordinated through vendor channels including the Red Hat Bugzilla Report #2510614. Apply vendor-provided packages once released and restart any long-running media services.

Workarounds

Terminate GStreamer processes handling RTP input from untrusted networks until patches are applied.
Place a session border controller or media proxy in front of RTP endpoints to validate fragmentation state and drop malformed streams.
Enforce systemd MemoryMax= or container memory limits on media services to contain the impact of process termination.

bash

# Example systemd unit hardening to cap memory for a GStreamer service
# /etc/systemd/system/gst-media.service.d/override.conf
[Service]
MemoryMax=512M
MemoryHigh=384M
Restart=on-failure
RestartSec=5s