CVE-2026-18649: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-18649 is an unbounded memory growth vulnerability in the GStreamer gst-plugins-good package affecting the rtph264depay and rtph265depay RTP depayloader elements. A remote, unauthenticated attacker can send a continuous stream of fragmented RTP packets without an end-of-fragment marker, causing the reassembly buffer to grow without bound until process memory is exhausted, resulting in a denial of service via process termination. The vulnerability was reported by Yehia Ali Mohamed Ezzat (0xSemizzz) and publicly disclosed on August 6, 2026. Affected Red Hat packages include gstreamer1-plugins-good on RHEL 8, 9, and 10; upstream GStreamer versions 1.28.2 and 1.28.5 were confirmed vulnerable. It carries a CVSS v3.1 base score of 7.5 (High) (Red Hat CVE, Github Advisory).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). In gstrtph264depay.c, the FU-A/FU-B fragmentation handler (cases 28/29 in gst_rtp_h264_depay_process()) accumulates incoming RTP fragment payloads into a GstAdapter via gst_adapter_push() without enforcing any maximum reassembly size. The adapter is only flushed when the End (E) bit is set in the FU header; if an attacker sends a start fragment (S=1, E=0) followed by an unlimited stream of continuation fragments (S=0, E=0) with sequential RTP sequence numbers, the adapter grows without bound. The identical flaw exists in gstrtph265depay.c (case 49 in gst_rtp_h265_depay_process()). Exploitation requires no authentication and no user interaction — only network access to a GStreamer pipeline receiving raw unauthenticated RTP over UDP (e.g., udpsrc directly feeding rtph264depay); pipelines using SRTP or DTLS-SRTP are not exposed (Red Hat CVE, Red Hat Bugzilla).

Successful exploitation results in complete denial of service for the affected GStreamer process through memory exhaustion and process termination. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. Affected deployments include any application using rtph264depay or rtph265depay to process RTP streams from untrusted or unauthenticated sources, such as streaming servers, video conferencing endpoints, or surveillance systems; desktop media playback from local files is not affected (Red Hat CVE, Github Advisory).

A public proof-of-concept exploit (trigger.py) is available on GitHub, consisting of a Python script that sends crafted RTP fragments to a target GStreamer process listening on UDP, demonstrating observable memory growth and process crash (Feedly PoC). The attack is fully automatable with no privileges or user interaction required. As of the time of reporting, there is no evidence of in-the-wild exploitation, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.56%, indicating a low but non-negligible probability of exploitation in the near term (Github Advisory, Red Hat CVE).

1. Reconnaissance: Identify systems running GStreamer pipelines that receive raw unauthenticated RTP over UDP (e.g., using udpsrc ! rtph264depay or udpsrc ! rtph265depay). Scan for open UDP ports commonly used for RTP streams (e.g., UDP/5004, UDP/5036).
2. Prepare the payload: Using the public PoC (trigger.py) or a custom script, craft RTP packets with the FU-A/FU-B fragmentation header set to Start (S=1, E=0) to initiate a fragmented NAL unit reassembly in the target depayloader.
3. Send continuous fragments: Transmit an unending stream of RTP continuation fragments (S=0, E=0) with sequential RTP sequence numbers to the target UDP port, never sending an end-of-fragment (E=1) packet. Each fragment is appended to the GstAdapter reassembly buffer without any size check.
4. Exhaust process memory: Continue sending fragments until the GStreamer process's memory is exhausted. The process will be terminated by the OS OOM killer or crash, achieving denial of service (Red Hat CVE, Red Hat Bugzilla, Feedly PoC).

• Network: High-volume UDP traffic directed at the RTP listening port of a GStreamer application (e.g., UDP/5004 or UDP/5036) from a single or rotating source IP; RTP packets with FU-A/FU-B fragmentation headers (NAL type 28/29 for H.264, type 49 for H.265) with Start bit set but no End bit ever transmitted.
• Process Behavior: Steadily increasing memory consumption of the GStreamer process (gst-launch-1.0 or application embedding GStreamer) without a corresponding increase in processed media output; eventual OOM kill or process crash.
• Logs: System logs (/var/log/messages, journalctl) showing OOM killer events targeting the GStreamer process (e.g., Out of memory: Kill process <pid> (gst-launch-1.0)); application logs showing unexpected process termination without a clean shutdown message.
• File System: Core dump files generated by the GStreamer process crash in /var/crash/ or the application working directory (Red Hat CVE, Feedly PoC).

Red Hat has released patched packages: gstreamer1-plugins-good-1.26.7-2.el10_2.3 for RHEL 10 (RHSA-2026:53451), gstreamer1-plugins-good-1.22.12-7.el9_8.2 for RHEL 9 (RHSA-2026:53452), and gstreamer1-plugins-good-1.16.1-7.el8_10.3 for RHEL 8 (RHSA-2026:56966). An upstream fix is tracked in GStreamer security MR #113, planned for GStreamer 1.28.6 or 1.28.7. Prior to patching, the following mitigations reduce risk: (1) deploy srtpdec before the depayloader to reject unauthenticated RTP fragments; (2) use firewall rules (iptables/nftables) to restrict RTP traffic to trusted sources only; (3) disable the RTP plugin at build time with -Drtp=disabled; or (4) prevent auto-plugging of the affected elements by setting GST_PLUGIN_FEATURE_RANK=rtph264depay:0,rtph265depay:0 (Red Hat CVE, RHSA-2026:53451, RHSA-2026:53452).

Red Hat acknowledged the vulnerability and credited Yehia Ali Mohamed Ezzat (GitHub: 0xSemizzz) as the reporter, rating it Moderate severity in their products. The researcher published a blog post detailing the vulnerability at https://0xsemizzz.vercel.app/blog/cve-2026-18649-gstreamer-rtp-dos/ and released a public PoC on GitHub shortly after disclosure. Coverage appeared on security aggregators including pro-linux.de and linuxsecurity.com, and the vulnerability was picked up by Nessus detection plugins within days of disclosure (Red Hat CVE, Red Hat Bugzilla).