CVE-2026-107660: FFmpeg before 8.1.3 and 9.x before 9.0.2 mbedTLS Hostname Verification Bypass for IP Hosts
FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tlsopen() of libavformat/tlsmbedtls.c, which skips hostname checks for IP-address hosts. Network attackers can intercept https, rtmps, or tls connections to IP-literal URLs with any trusted CA-issued certificate to read and tamper with streams.
Affected Software
Event History
Frequently Asked Questions
Which connections are affected?
The issue affects FFmpeg HTTPS, RTMPS, and TLS connections when the URL uses an IP address as the host rather than a hostname. Connections to IP-literal URLs can have their hostname verification skipped in the affected mbedTLS TLS implementation.
What does an attacker need to exploit this?
An attacker must be able to intercept the network connection. They can use any certificate issued by a trusted certificate authority, because the affected code does not verify that the certificate matches the IP-address host.
Which FFmpeg versions need updating?
Update FFmpeg to 8.1.3 or later in the 8.x line, or to 9.0.2 or later in the 9.x line. Versions before those releases are affected.
What can be done before updating?
Avoid using IP-literal URLs for HTTPS, RTMPS, or TLS streams. Use a hostname for the endpoint so hostname verification is applicable.