Server-Side Request Forgery in FFmpeg Affects Multiple Versions

CVE-2026-107698

What is CVE-2026-107698?

A server-side request forgery vulnerability exists in FFmpeg's handling of RTSP server responses. The flaw, located in ff_rtsp_connect() within the libavformat/rtsp.c file, allows malicious RTSP servers to redirect client requests to arbitrary internal server addresses without proper validation of the URL. This can lead to unauthorized access to sensitive internal network services and data, as the redirection bypasses established protocol whitelists designed to restrict requests. Users and administrators are encouraged to upgrade to the latest versions to mitigate potential exploitation.

References