Bug 2548122 (CVE-2026-107698) - CVE-2026-107698 ffmpeg: ffmpeg: Server-Side Request Forgery via unvalidated RTSP redirects
Summary: CVE-2026-107698 ffmpeg: ffmpeg: Server-Side Request Forgery via unvalidated R...
Keywords:
Status: NEW
Alias: CVE-2026-107698
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2549538 2549539 2549540 2549541 2549542 2549543
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-08 17:51 UTC by OSIDB Bzimport
Modified: 2026-10-12 11:55 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-08 17:51:53 UTC 
FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes, bypassing -protocol_whitelist, to probe internal network services.
Note You need to log in before you can comment on or make changes to this bug.