FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any… (CVE-2026-107696)

The vulnerability in FFmpeg up to version 9.0.2 is an infinite loop in the RTSP connection handling code (ff_rtsp_connect in libavformat/rtsp.c). The function does not impose a limit on following RTSP 3xx redirect responses, allowing an attacker controlling an RTSP server to cause the client to continuously reconnect by issuing 302 redirects to itself or other servers. This results in a denial-of-service condition by saturating a CPU core.

This vulnerability can be exploited by an attacker controlling an RTSP server to cause a denial-of-service (DoS) condition on clients using vulnerable FFmpeg versions. The endless reconnect loop consumes CPU resources, potentially degrading or disrupting service availability. There is no impact on confidentiality or integrity reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid connecting to untrusted RTSP servers or implement external controls to limit redirect handling.