Disclosure summary
FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core.
Source-reported weakness categories
CWE-835
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST National Vulnerability Database · NVD-CVE-2026-107696
Open original source · Updated Oct 09, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
Original records & references
- NIST NVD record
- CVE Program record
- code.ffmpeg.org
- gist.github.com
- github.com
- github.com
- www.vulncheck.com
PUBLISHED 2026-10-08T14:17:26-04:00
MODIFIED 2026-10-09T08:17:09-04:00
INGESTED 2026-10-10T20:55:03-04:00