A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter's terminator can cause an internal length calculation to underflow, leading to a crash of the process parsing the header. On an RTSP server this can be triggered by a remote, unauthenticated attacker sending a single malformed request when the server has authentication enabled; the same flaw can also be triggered against an RTSP client by a malicious or compromised RTSP server. Successful exploitation results in a denial of service (application crash) and has no confirmed impact on confidentiality or integrity.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1897:03 advisory.

    * gstreamer: GStreamer: Arbitrary code execution via OGG file parsing buffer overflow (CVE-2026-18297)
      * gstreamer1-plugins-base: gstreamer: NULL/invalid-pointer dereference in     gst_rtsp_message_parse_auth_credentials() when parsing a crafted Digest Authorization/WWW-Authenticate     header (CVE-2026-85150)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:69100 advisory.

    * gstreamer: GStreamer: Arbitrary code execution via OGG file parsing buffer overflow (CVE-2026-18297)

    * gstreamer1-plugins-base: gstreamer: NULL/invalid-pointer dereference in     gst_rtsp_message_parse_auth_credentials() when parsing a crafted Digest Authorization/WWW-Authenticate     header (CVE-2026-85150)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-69100 advisory.

    - Fix CVE-2026-18297: opusdec channel position bounds check       Resolves: RHEL-246587
    - Fix crash in RTSP auth credential parsing (CVE-2026-85150)       Resolves: RHEL-253753

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:69100 advisory.

    * gstreamer: GStreamer: Arbitrary code execution via OGG file parsing buffer overflow (CVE-2026-18297)
      * gstreamer1-plugins-base: gstreamer: NULL/invalid-pointer dereference in     gst_rtsp_message_parse_auth_credentials() when parsing a crafted Digest Authorization/WWW-Authenticate     header (CVE-2026-85150)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69100 advisory.

    GStreamer is a streaming media framework based on graphs of filters which operate on media data. The     gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins.

    Security Fix(es):

    * gstreamer: GStreamer: Arbitrary code execution via OGG file parsing buffer overflow (CVE-2026-18297)

    * gstreamer1-plugins-base: gstreamer: NULL/invalid-pointer dereference in     gst_rtsp_message_parse_auth_credentials() when parsing a crafted Digest Authorization/WWW-Authenticate     header (CVE-2026-85150)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1837:02 advisory.

    * gstreamer1-plugins-base: gstreamer: NULL/invalid-pointer dereference in     gst_rtsp_message_parse_auth_credentials() when parsing a crafted Digest Authorization/WWW-Authenticate     header (CVE-2026-85150)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:67145 advisory.

    * gstreamer1-plugins-base: gstreamer: NULL/invalid-pointer dereference in     gst_rtsp_message_parse_auth_credentials() when parsing a crafted Digest Authorization/WWW-Authenticate     header (CVE-2026-85150)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-671450 advisory.

    - Add patch for CVE-2026-85150       Resolves: RHEL-253741

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:67145 advisory.

    * gstreamer1-plugins-base: gstreamer: NULL/invalid-pointer dereference in     gst_rtsp_message_parse_auth_credentials() when parsing a crafted Digest Authorization/WWW-Authenticate     header (CVE-2026-85150)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67145 advisory.

    GStreamer is a streaming media framework based on graphs of filters which operate on media data. The     gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins.

    Security Fix(es):

    * gstreamer1-plugins-base: gstreamer: NULL/invalid-pointer dereference in     gst_rtsp_message_parse_auth_credentials() when parsing a crafted Digest Authorization/WWW-Authenticate     header (CVE-2026-85150)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-664600 advisory.

    [1.26.7-2.2]
    - Fix crash in RTSP auth credential parsing (CVE-2026-85150)       Resolves: RHEL-253746

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:66460 advisory.

    * gstreamer1-plugins-base: gstreamer: NULL/invalid-pointer dereference in     gst_rtsp_message_parse_auth_credentials() when parsing a crafted Digest Authorization/WWW-Authenticate     header (CVE-2026-85150)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:66460 advisory.

    * gstreamer1-plugins-base: gstreamer: NULL/invalid-pointer dereference in     gst_rtsp_message_parse_auth_credentials() when parsing a crafted Digest Authorization/WWW-Authenticate     header (CVE-2026-85150)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:66460 advisory.

    GStreamer is a streaming media framework based on graphs of filters which operate on media data. The     gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins.

    Security Fix(es):

    * gstreamer1-plugins-base: gstreamer: NULL/invalid-pointer dereference in     gst_rtsp_message_parse_auth_credentials() when parsing a crafted Digest Authorization/WWW-Authenticate     header (CVE-2026-85150)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs     while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially     crafted whitespace placement around a parameter's terminator can cause an internal length calculation to     underflow, leading to a crash of the process parsing the header. On an RTSP server this can be triggered     by a remote, unauthenticated attacker sending a single malformed request when the server has     authentication enabled; the same flaw can also be triggered against an RTSP client by a malicious or     compromised RTSP server. Successful exploitation results in a denial of service (application crash) and     has no confirmed impact on confidentiality or integrity. (CVE-2026-85150)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
349513	MiracleLinux 9 : gstreamer1-plugins-base-1.22.12-8.el9_8.2 (AXSA:2026-1897:03)	Nessus	Miracle Linux Local Security Checks	Local	high
349097	RockyLinux 9 : gstreamer1-plugins-base (RLSA-2026:69100)	Nessus	Rocky Linux Local Security Checks	Local	high
348776	Oracle Linux 9 : gstreamer1-plugins-base (ELSA-2026-69100)	Nessus	Oracle Linux Local Security Checks	Local	high
348737	AlmaLinux 9 : gstreamer1-plugins-base (ALSA-2026:69100)	Nessus	Alma Linux Local Security Checks	Local	high
348587	RHEL 9 : gstreamer1-plugins-base (RHSA-2026:69100)	Nessus	Red Hat Local Security Checks	Local	high
345891	MiracleLinux 8 : gstreamer1-plugins-base-1.16.1-7.el8_10 (AXSA:2026-1837:02)	Nessus	Miracle Linux Local Security Checks	Local	high
345870	RockyLinux 8 : gstreamer1-plugins-base (RLSA-2026:67145)	Nessus	Rocky Linux Local Security Checks	Local	high
345748	Oracle Linux 8 : ELSA-2026-67145-0: / gstreamer1-plugins-base (ELSA-2026-671450)	Nessus	Oracle Linux Local Security Checks	Local	high
345623	AlmaLinux 8 : gstreamer1-plugins-base (ALSA-2026:67145)	Nessus	Alma Linux Local Security Checks	Local	high
345569	RHEL 8 : gstreamer1-plugins-base (RHSA-2026:67145)	Nessus	Red Hat Local Security Checks	Local	high
344854	Oracle Linux 10 : ELSA-2026-66460-0: / gstreamer1-plugins-base (ELSA-2026-664600)	Nessus	Oracle Linux Local Security Checks	Local	high
344850	AlmaLinux 10 : gstreamer1-plugins-base (ALSA-2026:66460)	Nessus	Alma Linux Local Security Checks	Local	high
344835	RockyLinux 10 : gstreamer1-plugins-base (RLSA-2026:66460)	Nessus	Rocky Linux Local Security Checks	Local	high
344775	RHEL 10 : gstreamer1-plugins-base (RHSA-2026:66460)	Nessus	Red Hat Local Security Checks	Local	high
342625	Linux Distros Unpatched Vulnerability : CVE-2026-85150	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-85150

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high