FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that… (CVE-2026-107698)

FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in the ff_rtsp_connect() function in libavformat/rtsp.c. The vulnerability arises because FFmpeg follows RTSP 3xx redirects without validating the Location URL. This allows a malicious RTSP server to redirect FFmpeg to internal network hosts and ports, potentially bypassing the -protocol_whitelist restriction, enabling probing of internal network services.

An attacker controlling a malicious RTSP server can exploit this vulnerability to cause FFmpeg to send requests to internal network hosts and ports that would otherwise be inaccessible. This can lead to unauthorized internal network reconnaissance. The impact is limited to information disclosure and network probing, with no direct impact on confidentiality, integrity, or availability of FFmpeg itself.

No explicit patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious when processing RTSP streams from untrusted sources and consider restricting network access or using network-level controls to limit FFmpeg's ability to reach internal services.