CVE-2026-107677

A flaw was found in FFmpeg. An attacker could cause a Denial of Service DoS by supplying a specially crafted media presentation description .mpd manifest containing an empty media segment URL. When processed by the Dynamic Adaptive Streaming over HTTP DASH demuxer, this input triggers an infinite...

CVE-2026-107677

FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media="" so getcurrentfragment calls avstrireplace...

CVE-2026-107677

Versions of FFmpeg through 9.0.2 are vulnerable to a denial of service (DoS) condition in the DASH demuxer . The root cause is an infinite loop triggered when a crafted .mpd manifest contains an empty SegmentTemplate media URL (e.g., media=""). This causes the get_current_fragment() function to c...

CVE-2026-107677 FFmpeg through 9.0.2 DASH Demuxer Infinite Loop via Empty SegmentTemplate Media

FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media="" so getcurrentfragment calls avstrireplace...

EUVD-2026-95082

FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media="" so getcurrentfragment calls avstrireplace...

CVE-2026-38361

CVE-2026-38361: dash-uploader における複数の未認証 DoS 脆弱性 fohrloop/dash-uploader Python、PyPI には、複数の未認証の サービス拒否 DoS 問題があります。これらに限定されませんが メモリ不足 OOM によるプロセスクラッシュ、ファイルの 0 バイトへの切り詰め、永続的なディスク枯渇、文書化された maxfilesize 制限の完全なバイパスが含まれます。同じサニタイズされていないパラメータセットを通じて、追加のリソース悪用経路も存在します。 ⚠️ パッチは提供されておらず、今後も提供される予定はありません...

CVE-2026-38360

CVE-2026-38360: dash-uploader におけるパストラバーサル 認証なしのパストラバーサルが fohrloop/dash-uploader（Python、PyPI）に存在し、任意のファイル書き込みが可能になります。これは、リモートコード実行（RCE） 、アプリケーションのソースコード上書き、格納型XSS、永続的なバックドアのインストールなど（これらに限定されません）を引き起こします。 ⚠️ パッチは提供されておらず、今後も提供される予定はありません リポジトリは2025-07-19にアーカイブされ、アクティブなメンテナはいません。公開されている全バージョン（0.1.0...

Dash Framework - Cross-site Scripting

Dash framework versions before 2.15.0 are vulnerable to Cross-site Scripting XSS via href attribute in anchor tags. This template tests for javascript:alert payload injection. id: CVE-2024-21485 info: name: Dash Framework - Cross-site Scripting author: Lee Changhyuneeche severity: medium...

dash-uploader 0.1.0 - 0.7.0a2 - Denial-of-Service via flowTotalChunks

fohrloop dash-uploader v0.1.0 through v0.7.0a2 contains a remote code execution caused by improper handling in Upload function and maxfilesize parameter in dashuploader components, letting remote attackers execute arbitrary code, exploit requires crafted request. id: CVE-2026-38361 info: name:...

dash-uploader 0.1.0 - 0.7.0a2 - Unauthenticated Arbitrary File Write via Path Traversal

fohrloop dash-uploader v0.1.0 through v0.7.0a2 contains a directory traversal vulnerability caused by improper handling in dashuploader/httprequesthandler.py components, letting remote attackers execute arbitrary code, exploit requires no special privileges. id: CVE-2026-38360 info: name:...

PT-2026-108038

FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media="" so get current fragment calls av strirepla...

PT-2026-105689

These are all security issues fixed in the dash-0.5.13.5-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11980-1 dash-0.5.13.5-1.1 on GA media

These are all security issues fixed in the dash-0.5.13.5-1.1 package on the GA media of openSUSE Tumbleweed...

Linux Distros Unpatched Vulnerability : CVE-2026-103227

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A weakness has been identified in GPAC up to 26.07.0. Affected by this issue is the function gfdashresolveurl of the file src/mediatools/dashclient.c of the...

CVE-2026-103227

A weakness has been identified in GPAC up to 26.07.0. Affected by this issue is the function gfdashresolveurl of the file src/mediatools/dashclient.c of the component DASH Client. This manipulation causes buffer overflow. The attack is possible to be carried out remotely. Upgrading to version...

CVE-2026-103227

A weakness has been identified in GPAC up to 26.07.0. Affected by this issue is the function gfdashresolveurl of the file src/mediatools/dashclient.c of the component DASH Client. This manipulation causes buffer overflow. The attack is possible to be carried out remotely. Upgrading to version...

UBUNTU-CVE-2026-103227

A weakness has been identified in GPAC up to 26.07.0. Affected by this issue is the function gfdashresolveurl of the file src/mediatools/dashclient.c of the component DASH Client. This manipulation causes buffer overflow. The attack is possible to be carried out remotely. Upgrading to version...

CVE-2026-103227 GPAC DASH Client dash_client.c gf_dash_resolve_url buffer overflow

A weakness has been identified in GPAC up to 26.07.0. Affected by this issue is the function gfdashresolveurl of the file src/mediatools/dashclient.c of the component DASH Client. This manipulation causes buffer overflow. The attack is possible to be carried out remotely. Upgrading to version...

CVE-2026-103227 GPAC DASH Client dash_client.c gf_dash_resolve_url buffer overflow

A weakness has been identified in GPAC up to 26.07.0. Affected by this issue is the function gfdashresolveurl of the file src/mediatools/dashclient.c of the component DASH Client. This manipulation causes buffer overflow. The attack is possible to be carried out remotely. Upgrading to version...

CVE-2026-103227

A buffer overflow vulnerability exists in GPAC up to version 26.07.0 . The issue originates in the DASH Client component, specifically within the gf_dash_resolve_url function located in src/media_tools/dash_client.c. This flaw allows for remote exploitation by an attacker. To remediate this vulne...