Moderate Security Vulnerability in gstreamer1-plugins-good: Unbounded Memory Growth
Summary
ALSA-2026:53451: Moderate: gstreamer1-plugins-good security update. Affects gstreamer1-plugins-good versions < 1.26.7-2.el10_2.3. Fixed in 1.26.7-2.el10_2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GStreamer is a powerful streaming media framework that allows developers to create applications that handle audio and video data. The gstreamer1-plugins-good package contains a collection of high-quality, well-supported plugins that are licensed under the LGPL. These plugins are essential for various media processing tasks, but they are susceptible to vulnerabilities that can affect system performance and security.
Vulnerability Detail
The vulnerability identified as CVE-2026-18649 pertains to unbounded memory growth in the RTP depayloaders, specifically rtph264depay and rtph265depay. This issue arises when these plugins process RTP streams without proper memory management, leading to potential memory exhaustion and application crashes. If exploited, this vulnerability could allow an attacker to disrupt media processing applications, resulting in degraded performance or service outages.
How To Fix
Minimum fixed version
1.26.7-2.el10_2.3
This is the first release that contains the fix.
sudo dnf update gstreamer1-plugins-goodTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the input streams processed by the affected plugins or monitor memory usage closely to prevent application crashes until the update can be applied.
Conclusion
The gstreamer1-plugins-good package has a moderate security vulnerability that can lead to unbounded memory growth in specific RTP depayloaders. It is crucial to update to the latest patched version to mitigate potential risks. Users should also consider using tools like Vulert to monitor their applications for vulnerabilities.
See every vulnerability recorded for gstreamer1-plugins-good →
FAQ
CVE-2026-18649 is a security vulnerability in the gstreamer1-plugins-good package that causes unbounded memory growth in certain RTP depayloaders.
This vulnerability can lead to memory exhaustion, causing applications that rely on the affected plugins to crash or perform poorly.
Yes, a patch is available in version 1.26.7-2.el10_2.3 of the gstreamer1-plugins-good and gstreamer1-plugins-good-gtk packages.
You can use Vulert, which monitors open-source vulnerabilities in your software by analyzing your manifest file. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If immediate updates are not possible, consider limiting the input streams to the affected plugins and monitoring memory usage closely.
Related vulnerabilities
Recent vulnerabilities recorded for gstreamer1-plugins-good.
