CVE-2026-18649: Denial of Service in GStreamer RTP

CVE-2026-18649 is a denial of service flaw in the GStreamer gst-plugins-good package affecting the rtph264depay and rtph265depay RTP depayloader elements. The vulnerability resides in the absence of maximum size limit enforcement on the reassembly buffer used during fragmented RTP packet processing. Any service relying on GStreamer for network media stream processing—such as video streaming, communication applications, or media servers—is potentially vulnerable.

Severity is rated CVSS 7.5 (high) and is confirmed as a remote denial of service vulnerability. An unauthenticated attacker can send a continuous stream of RTP fragments without ever transmitting an end-of-fragment marker, causing the reassembly buffer to grow without bound until available memory is exhausted and the process crashes. The flaw was published on NVD on 2026-08-06, and a GitHub repository signal from 2026-10-31 reports public analysis of the vulnerability, suggesting growing attention from the research community.

In defense: immediately verify which production systems use GStreamer gst-plugins-good and which versions are deployed. Check the official GStreamer site for available patches and apply them as soon as possible. In the meantime, implement rate limits on incoming fragmented RTP packets if your infrastructure allows, and evaluate network isolation for services processing RTP until a verified fix is released. Monitor crash logs and memory anomalies in GStreamer processes.