Skip to content

GHSA-4mc6-qmpp-g7gw on CTRL-OS 26.05

Aliases: GHSA-4mc6-qmpp-g7gw

Packages: srt

Status: Plausible

Advisory Information

Impact

SRT control packets carry no Message Authentication Code (MAC). An attacker who has network access to the receiver's listening port, or who can observe an active session's 5-tuple (source IP, source port, destination IP, destination port, SRT socket ID) and send spoofed packets to the receiver, can send a forged KMREQ control message that causes the receiver's encryption state to transition from SECURED to BADSECRET. Once downgraded, the receiver accepts unencrypted data packets from any sender, enabling stream hijacking, content injection, and interruption of live media.

This vulnerability affects SRT receivers processing encrypted streams. Receivers in listener mode with accessible ports are directly exploitable. Receivers in any connection mode are exploitable if the attacker can observe the session's 5-tuple (source IP, destination IP, source UDP port, destination UDP port, and SRT socket ID) and send spoofed packets to the receiver. SRT senders are not affected. Unencrypted SRT sessions are not affected — the vulnerability specifically targets the mechanism that enforces encryption, causing the receiver to accept unencrypted data in place of the legitimate encrypted stream. Standard network security practices (VPN, private connectivity, network segmentation) significantly reduce the attack surface by limiting port accessibility and preventing observation or spoofing of session traffic.

Patches

https://github.com/Haivision/srt/releases/tag/v1.5.6 https://github.com/Haivision/srt/pull/3345

Workarounds

None at this time.

References

https://www.haivision.com/product-bulletin-srt-security-advisory/ https://srtalliance.org/srt-alliance-security-advisory/

Updates

2026-07-21 16:00 CEST

Metadata changes:

  • Status for package srt: “Plausible”

2026-07-21 15:59 CEST

Metadata changes:

  • Status for package srt: “New”

(Amended on: 2026-07-21 16:00 CEST)