CVE-2026-107698: FFmpeg before 7.1.4 and 8.0.2 SSRF via RTSP Redirect Handling
FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ffrtspconnect() in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes, bypassing -protocolwhitelist, to probe internal network services.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications are exposed when they use affected FFmpeg versions to connect to RTSP servers that may be malicious or attacker-controlled. The malicious server can cause FFmpeg to make requests toward internal hosts and ports.
What does an attacker need to exploit it?
An attacker needs to control, or cause the application to connect to, an RTSP server that returns a 3xx redirect with a crafted Location URL. No FFmpeg privileges are required, but user interaction is required according to the supplied CVSS vector.
Does using -protocol_whitelist prevent exploitation?
No. The issue can bypass -protocol_whitelist because RTSP redirects are followed without validating the redirect Location URL, including redirects to other schemes.
Which versions should be remediated?
Upgrade FFmpeg to 7.1.4 or later in the 7.1 line, or to 8.0.2 or later in the 8.0 line. Versions before 7.1.4 and 8.0.x versions before 8.0.2 are affected.