← Back to Security Research Portal (ccsimplyspolit.github.io)

GHSA-qr8h-p53p-x564: RTC Crash and Heap Overflow from a Malformed RTCP Packet (ossrs/srs)

[PUBLISHED BY VENDOR • CVE REQUESTED FROM GITHUB CNA • FIXED IN v6.0-r3 (PR #4669)]
Privately reported to ossrs/srs via GitHub Private Vulnerability Reporting (GHSA-qr8h-p53p-x564) covering RTCP compound packet length and XR/TWCC header bounds validation in srs_kernel_rtc_rtcp.cpp (CWE-125 / CWE-191 / CWE-835, High 8.2).
Confirmed, patched in Pull Request #4669 (commit e3830fc46), and officially published by SRS lead maintainer Winlin (@winlinvip) on 2026-10-30T14:14:41Z with accepted reporter credit to @ccsimplyspolit.

0x00 // GitHub Security Advisory & Remediation Metadata

{
  "ghsa_id": "GHSA-qr8h-p53p-x564",
  "repository": "ossrs/srs",
  "html_url": "https://github.com/ossrs/srs/security/advisories/GHSA-qr8h-p53p-x564",
  "fix_pr": "https://github.com/ossrs/srs/pull/4669",
  "fix_commit": "https://github.com/ossrs/srs/commit/e3830fc46",
  "state": "published",
  "published_at": "2026-10-30T14:14:41Z",
  "cve_request_status": "Requested by maintainer (@winlinvip) via GitHub CNA",
  "summary": "RTC: Crash and heap overflow from a malformed RTCP packet",
  "severity": "high",
  "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
  "credits": [
    {
      "login": "ccsimplyspolit",
      "type": "reporter",
      "state": "accepted"
    }
  ],
  "cwe_ids": [
    "CWE-125",
    "CWE-191",
    "CWE-835"
  ]
}