fix race condition that prevents decoding the stream (bluenviron/mediamtx-rpicamera#109) (#5861) When a player immediately connects to a newly-created stream, SPS/PPS might not be available, neither in the SDP and neither in-band. Prevent the issue by always sending SPS/PPS in-band.
code.cloudfoundry.org/bytefmt updated from v0.76.0 to v0.78.0
github.com/abema/go-mp4 updated from v1.6.0 to v1.7.1
github.com/bluenviron/gortsplib/v5 updated from v5.6.0 to v5.6.1
github.com/bluenviron/mediacommon/v2 updated from v2.9.0 to v2.9.1
github.com/matthewhartstonge/argon2 updated from v1.5.4 to v1.5.5
github.com/pion/sdp/v3 updated from v3.0.18 to v3.0.19
github.com/quic-go/webtransport-go updated from v0.10.0 to v0.11.0
github.com/pion/srtp/v3 updated from v3.0.11 to v3.0.12
github.com/bluenviron/mediamtx-rpicamera updated from v2.6.0 to v2.8.0
Security
Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.
Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:
ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx
You can verify checksums of binaries by downloading checksums.sha256 and running:
GHSA-vrfp-mg3q-3959: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
GHSA-wcvv-g26m-wx5c: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE
GHSA-x348-j6c9-77f3: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer
GHSA-xgj6-2gc5-5x9c: ast_loggrabber executes python script in world writable directory(/tmp) leading to potential privilege escalation And RCE
User Notes:
Upgrade Notes:
Developer Notes:
ARI: Make ARI applications respect live_dangerously.
ARI applications can no longer call "dangerous" dialplan
functions like DB(), FILE(), SHELL(), CURL(), STAT(), etc. without
enabling "live_dangerously" in asterisk.conf.
Resolves: #GHSA-vrfp-mg3q-3959
Commit Authors:
George Joseph: (6)
Mike Bradeen: (3)
Milan Kyselica: (7)
Pengpeng Hou: (1)
Roberto Paleari: (1)
ThatTotallyRealMyth: (1)
Issue and Commit Detail:
Closed Issues:
!GHSA-3g56-cgrh-95p5: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk
!GHSA-3rhj-hhw7-m6fw: NULL Pointer Dereference in HTTP AMI Digest Authentication
res_ari: Ensure read-only users are properly authorized via REST Over WebSocket.
Author: George Joseph
Date: 2026-06-12
The REST over WebSocket path now properly prevents non-GET methods from
being executed on inbound WebSockets.
The query parameters from the original incoming GET request that caused the
upgrade to WebSocket are now passed to all REST requests that come from the
client. This ensures that if the client authenticated with a read-only
userid using the "api_key" query_string parameter, REST requests coming
in over the WebSocket will only be able to execute GETs on resources.
The HTTP headers were already passed to the REST requests so if the
client had authenticated via an "Authorization" it was properly handled.
New tests have been added to test_ari.c to check that read-only users
are properly denied access to resources using non-GET methods. Several
memory leaks were also squashed.
pjsip_message_filter: Use pj_strdup instead of pj_strassign to save local address.
Author: George Joseph
Date: 2026-06-10
The filter_on_tx_message() function was using pj_strassign() to save the pointer
of the pjproject transport local address to a local pj_str_t variable. That
variable was ultimately used to set the Contact header's uri->host and the SDP
connection attribute's address again using pj_strassign. pj_strassign() doesn't
copy the actual value of the pj_str_t however, it just copies the pointer so
if a connection-oriented transport is disconnected before the 200 OK with the
SDP is sent, those pointers will be invalid which can cause use-after-free
issues. To prevent this, filter_on_tx_message() now uses pj_strdup with the
tdata->pool as the backing store to save the local IP address to the local
variable. pj_strassign() can then be used safely later on since the tdata
will be available for the life of the transaction.
ARI: Make ARI applications respect live_dangerously.
Author: George Joseph
Date: 2026-05-21
DeveloperNote: ARI applications can no longer call "dangerous" dialplan
functions like DB(), FILE(), SHELL(), CURL(), STAT(), etc. without
enabling "live_dangerously" in asterisk.conf.
res_rtp_asterisk.c: Address 2 potential T.140 RED buffer overruns.
Author: George Joseph
Date: 2026-04-27
Add check to red_t140_to_red() to ensure that the new primary payload
can't cause the rtp_red->len array items to wrap or cause an overrun of
the rtp_red->t140red_data buffer.
Add check to rtp_red_buffer() to ensure that a T.140 frame to be sent
can't cause rtp_red->len array items to wrap or cause an overrun of
the rtp_red->buf_data buffer.
res/res_pjsip_pubsub.c: Fix buffer over-read in MWI body parser
Author: Roberto Paleari
Date: 2026-04-29
Add constraint checks to prevent unauthenticated users from crashing Asterisk
instance by sending a crafted inbound SIP NOTIFY request with "Content-Type:
application/simple-message-summary".
app_sms: Bound protocol 1 SMS unpacking to fixed-size buffers
Author: Pengpeng Hou
Date: 2026-04-01
The protocol 1 unpack helpers trusted externally controlled lengths and wrote
them directly into fixed-size buffers in sms_t. Clamp the address, header,
and body copies to the destination array sizes so malformed messages cannot
overwrite adjacent state.
res_xmpp: Fix stack buffer overflow in namespace prefix handling
Author: Milan Kyselica
Date: 2026-03-26
The snprintf size parameter in xmpp_action_hook() is computed from
the attacker-controlled namespace prefix length and is not bounded
by the 256-byte stack buffer size. When a remote XMPP peer sends a
stanza with a child element whose namespace prefix exceeds 249
characters, snprintf writes past the buffer boundary.
Use sizeof(attr) as the snprintf size limit and %.*s precision to
extract only the prefix portion of the element name, preserving
the original truncation behavior for valid inputs.
res_pjsip_pubsub: Add width limit to sscanf in MWI NOTIFY parser
Author: Milan Kyselica
Date: 2026-03-24
The parse_simple_message_summary() function uses sscanf with an
unbounded %s format specifier to parse the Message-Account field
from incoming SIP NOTIFY bodies into a fixed-size 512-byte stack
buffer (PJSIP_MAX_URL_SIZE). A single unauthenticated SIP NOTIFY
with a Message-Account value exceeding 512 bytes overflows the
buffer, corrupting adjacent stack data and permanently disabling
the PJSIP transport layer without crashing the process.
Add a width specifier (%511s) to limit the sscanf write to
PJSIP_MAX_URL_SIZE - 1 bytes plus the NUL terminator, matching
the destination buffer size.
res_config_ldap: Escape LDAP filter values per RFC 4515
Author: Milan Kyselica
Date: 2026-03-23
The LDAP realtime driver constructs search filters by directly
concatenating user-supplied values without RFC 4515 escaping.
When LDAP is used as a realtime backend for endpoint
identification, characters with special meaning in LDAP filters
(*, (, ), ) can be injected via the SIP From header username.
Add ldap_filter_escape_value() that escapes RFC 4515 special
characters to their \HH hex representation, and apply it to
non-LIKE query values. The LIKE query path preserves the existing
wildcard conversion behavior with a note for maintainers.
cel_pgsql, cel_tds: Escape eventtype field to prevent SQL injection
Author: Milan Kyselica
Date: 2026-03-23
The eventtype column handler in cel_pgsql.c inserts
record.user_defined_name directly into the SQL query without
calling PQescapeStringConn(), while all other string fields in
the same function are properly escaped. Similarly, cel_tds.c
passes the raw user_defined_name into the SQL INSERT without
routing it through anti_injection(), while all other fields are
processed through that function.
For cel_pgsql.c, escape the eventtype value using
PQescapeStringConn(), matching the existing pattern used for all
other string fields at lines 308-331 of the same function.
For cel_tds.c, route the eventtype value through
anti_injection() consistent with how all other fields are handled
in the same function.
http: Escape error page text to prevent reflected XSS
Author: Milan Kyselica
Date: 2026-04-08
The text parameter in ast_http_create_response() is inserted into
the HTML body without escaping, while the server name on the same
page is properly escaped via ast_xml_escape(). When res_phoneprov
passes the decoded request URI as the text of a 404 response, HTML
metacharacters in the URI are rendered by the browser.
Apply ast_xml_escape() to the text parameter before inserting it
into the HTML template, using the same function already used for
the server name.
codec_codec2: Only process complete Codec2 frames in decoder
Author: Milan Kyselica
Date: 2026-04-08
The codec2_samples() function uses floor division (160 * datalen/6)
to compute expected output samples, but the decode loop condition
(x < datalen) iterates with ceiling behavior when datalen is not a
multiple of CODEC2_FRAME_LEN. This mismatch causes the loop to
decode one extra frame beyond what the framework bounds check
budgeted for, leading to an out-of-bounds write on the output buffer.
Change the loop condition to only process complete frames, matching
the floor-division behavior of codec2_samples(). This also prevents
an out-of-bounds read on the input side when fewer than
CODEC2_FRAME_LEN bytes remain.
format_ogg_speex: Add bounds check to prevent heap buffer overflow
Author: Milan Kyselica
Date: 2026-03-23
The ogg_speex_read() function copies OGG packet data via memcpy()
without validating the packet size against the destination buffer
(BUF_SIZE = 200 bytes). A crafted .spx file with an oversized OGG
audio packet causes a heap buffer overflow that corrupts the
adjacent speex_desc structure containing libogg heap pointers,
leading to a crash (SIGSEGV) on playback.
Add a bounds check for both negative and oversized values before
the memcpy, consistent with how format_ogg_vorbis bounds its reads
via ov_read().
GHSA-vrfp-mg3q-3959: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
GHSA-wcvv-g26m-wx5c: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE
GHSA-x348-j6c9-77f3: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer
GHSA-xgj6-2gc5-5x9c: ast_loggrabber executes python script in world writable directory(/tmp) leading to potential privilege escalation And RCE
User Notes:
Upgrade Notes:
Developer Notes:
ARI: Make ARI applications respect live_dangerously.
ARI applications can no longer call "dangerous" dialplan
functions like DB(), FILE(), SHELL(), CURL(), STAT(), etc. without
enabling "live_dangerously" in asterisk.conf.
Resolves: #GHSA-vrfp-mg3q-3959
Commit Authors:
George Joseph: (6)
Mike Bradeen: (3)
Milan Kyselica: (7)
Pengpeng Hou: (1)
Roberto Paleari: (1)
ThatTotallyRealMyth: (1)
Issue and Commit Detail:
Closed Issues:
!GHSA-3g56-cgrh-95p5: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk
!GHSA-3rhj-hhw7-m6fw: NULL Pointer Dereference in HTTP AMI Digest Authentication
res_ari: Ensure read-only users are properly authorized via REST Over WebSocket.
Author: George Joseph
Date: 2026-06-12
The REST over WebSocket path now properly prevents non-GET methods from
being executed on inbound WebSockets.
The query parameters from the original incoming GET request that caused the
upgrade to WebSocket are now passed to all REST requests that come from the
client. This ensures that if the client authenticated with a read-only
userid using the "api_key" query_string parameter, REST requests coming
in over the WebSocket will only be able to execute GETs on resources.
The HTTP headers were already passed to the REST requests so if the
client had authenticated via an "Authorization" it was properly handled.
New tests have been added to test_ari.c to check that read-only users
are properly denied access to resources using non-GET methods. Several
memory leaks were also squashed.
pjsip_message_filter: Use pj_strdup instead of pj_strassign to save local address.
Author: George Joseph
Date: 2026-06-10
The filter_on_tx_message() function was using pj_strassign() to save the pointer
of the pjproject transport local address to a local pj_str_t variable. That
variable was ultimately used to set the Contact header's uri->host and the SDP
connection attribute's address again using pj_strassign. pj_strassign() doesn't
copy the actual value of the pj_str_t however, it just copies the pointer so
if a connection-oriented transport is disconnected before the 200 OK with the
SDP is sent, those pointers will be invalid which can cause use-after-free
issues. To prevent this, filter_on_tx_message() now uses pj_strdup with the
tdata->pool as the backing store to save the local IP address to the local
variable. pj_strassign() can then be used safely later on since the tdata
will be available for the life of the transaction.
ARI: Make ARI applications respect live_dangerously.
Author: George Joseph
Date: 2026-05-21
DeveloperNote: ARI applications can no longer call "dangerous" dialplan
functions like DB(), FILE(), SHELL(), CURL(), STAT(), etc. without
enabling "live_dangerously" in asterisk.conf.
res_rtp_asterisk.c: Address 2 potential T.140 RED buffer overruns.
Author: George Joseph
Date: 2026-04-27
Add check to red_t140_to_red() to ensure that the new primary payload
can't cause the rtp_red->len array items to wrap or cause an overrun of
the rtp_red->t140red_data buffer.
Add check to rtp_red_buffer() to ensure that a T.140 frame to be sent
can't cause rtp_red->len array items to wrap or cause an overrun of
the rtp_red->buf_data buffer.
res/res_pjsip_pubsub.c: Fix buffer over-read in MWI body parser
Author: Roberto Paleari
Date: 2026-04-29
Add constraint checks to prevent unauthenticated users from crashing Asterisk
instance by sending a crafted inbound SIP NOTIFY request with "Content-Type:
application/simple-message-summary".
app_sms: Bound protocol 1 SMS unpacking to fixed-size buffers
Author: Pengpeng Hou
Date: 2026-04-01
The protocol 1 unpack helpers trusted externally controlled lengths and wrote
them directly into fixed-size buffers in sms_t. Clamp the address, header,
and body copies to the destination array sizes so malformed messages cannot
overwrite adjacent state.
res_xmpp: Fix stack buffer overflow in namespace prefix handling
Author: Milan Kyselica
Date: 2026-03-26
The snprintf size parameter in xmpp_action_hook() is computed from
the attacker-controlled namespace prefix length and is not bounded
by the 256-byte stack buffer size. When a remote XMPP peer sends a
stanza with a child element whose namespace prefix exceeds 249
characters, snprintf writes past the buffer boundary.
Use sizeof(attr) as the snprintf size limit and %.*s precision to
extract only the prefix portion of the element name, preserving
the original truncation behavior for valid inputs.
res_pjsip_pubsub: Add width limit to sscanf in MWI NOTIFY parser
Author: Milan Kyselica
Date: 2026-03-24
The parse_simple_message_summary() function uses sscanf with an
unbounded %s format specifier to parse the Message-Account field
from incoming SIP NOTIFY bodies into a fixed-size 512-byte stack
buffer (PJSIP_MAX_URL_SIZE). A single unauthenticated SIP NOTIFY
with a Message-Account value exceeding 512 bytes overflows the
buffer, corrupting adjacent stack data and permanently disabling
the PJSIP transport layer without crashing the process.
Add a width specifier (%511s) to limit the sscanf write to
PJSIP_MAX_URL_SIZE - 1 bytes plus the NUL terminator, matching
the destination buffer size.
res_config_ldap: Escape LDAP filter values per RFC 4515
Author: Milan Kyselica
Date: 2026-03-23
The LDAP realtime driver constructs search filters by directly
concatenating user-supplied values without RFC 4515 escaping.
When LDAP is used as a realtime backend for endpoint
identification, characters with special meaning in LDAP filters
(*, (, ), ) can be injected via the SIP From header username.
Add ldap_filter_escape_value() that escapes RFC 4515 special
characters to their \HH hex representation, and apply it to
non-LIKE query values. The LIKE query path preserves the existing
wildcard conversion behavior with a note for maintainers.
cel_pgsql, cel_tds: Escape eventtype field to prevent SQL injection
Author: Milan Kyselica
Date: 2026-03-23
The eventtype column handler in cel_pgsql.c inserts
record.user_defined_name directly into the SQL query without
calling PQescapeStringConn(), while all other string fields in
the same function are properly escaped. Similarly, cel_tds.c
passes the raw user_defined_name into the SQL INSERT without
routing it through anti_injection(), while all other fields are
processed through that function.
For cel_pgsql.c, escape the eventtype value using
PQescapeStringConn(), matching the existing pattern used for all
other string fields at lines 308-331 of the same function.
For cel_tds.c, route the eventtype value through
anti_injection() consistent with how all other fields are handled
in the same function.
http: Escape error page text to prevent reflected XSS
Author: Milan Kyselica
Date: 2026-04-08
The text parameter in ast_http_create_response() is inserted into
the HTML body without escaping, while the server name on the same
page is properly escaped via ast_xml_escape(). When res_phoneprov
passes the decoded request URI as the text of a 404 response, HTML
metacharacters in the URI are rendered by the browser.
Apply ast_xml_escape() to the text parameter before inserting it
into the HTML template, using the same function already used for
the server name.
codec_codec2: Only process complete Codec2 frames in decoder
Author: Milan Kyselica
Date: 2026-04-08
The codec2_samples() function uses floor division (160 * datalen/6)
to compute expected output samples, but the decode loop condition
(x < datalen) iterates with ceiling behavior when datalen is not a
multiple of CODEC2_FRAME_LEN. This mismatch causes the loop to
decode one extra frame beyond what the framework bounds check
budgeted for, leading to an out-of-bounds write on the output buffer.
Change the loop condition to only process complete frames, matching
the floor-division behavior of codec2_samples(). This also prevents
an out-of-bounds read on the input side when fewer than
CODEC2_FRAME_LEN bytes remain.
format_ogg_speex: Add bounds check to prevent heap buffer overflow
Author: Milan Kyselica
Date: 2026-03-23
The ogg_speex_read() function copies OGG packet data via memcpy()
without validating the packet size against the destination buffer
(BUF_SIZE = 200 bytes). A crafted .spx file with an oversized OGG
audio packet causes a heap buffer overflow that corrupts the
adjacent speex_desc structure containing libogg heap pointers,
leading to a crash (SIGSEGV) on playback.
Add a bounds check for both negative and oversized values before
the memcpy, consistent with how format_ogg_vorbis bounds its reads
via ov_read().
GHSA-vrfp-mg3q-3959: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
GHSA-wcvv-g26m-wx5c: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE
GHSA-x348-j6c9-77f3: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer
GHSA-xgj6-2gc5-5x9c: ast_loggrabber executes python script in world writable directory(/tmp) leading to potential privilege escalation And RCE
User Notes:
acl: Add ACL support to http and ari
A new section, type=restriction has been added to http.conf
to allow an uri prefix based acl to be configured. See
http.conf.sample for examples and more information.
The user section of ari.conf can now contain an acl configuration
to restrict users access. See ari.conf.sample for examples and more
information
Upgrade Notes:
Developer Notes:
ARI: Make ARI applications respect live_dangerously.
ARI applications can no longer call "dangerous" dialplan
functions like DB(), FILE(), SHELL(), CURL(), STAT(), etc. without
enabling "live_dangerously" in asterisk.conf.
Resolves: #GHSA-vrfp-mg3q-3959
Commit Authors:
George Joseph: (6)
Joshua C. Colp: (1)
Mike Bradeen: (4)
Milan Kyselica: (7)
Pengpeng Hou: (1)
Roberto Paleari: (1)
ThatTotallyRealMyth: (1)
Issue and Commit Detail:
Closed Issues:
!GHSA-3g56-cgrh-95p5: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk
!GHSA-3rhj-hhw7-m6fw: NULL Pointer Dereference in HTTP AMI Digest Authentication
res_ari: Ensure read-only users are properly authorized via REST Over WebSocket.
Author: George Joseph
Date: 2026-06-12
The REST over WebSocket path now properly prevents non-GET methods from
being executed on inbound WebSockets.
The query parameters from the original incoming GET request that caused the
upgrade to WebSocket are now passed to all REST requests that come from the
client. This ensures that if the client authenticated with a read-only
userid using the "api_key" query_string parameter, REST requests coming
in over the WebSocket will only be able to execute GETs on resources.
The HTTP headers were already passed to the REST requests so if the
client had authenticated via an "Authorization" it was properly handled.
New tests have been added to test_ari.c to check that read-only users
are properly denied access to resources using non-GET methods. Several
memory leaks were also squashed.
pjsip_message_filter: Use pj_strdup instead of pj_strassign to save local address.
Author: George Joseph
Date: 2026-06-10
The filter_on_tx_message() function was using pj_strassign() to save the pointer
of the pjproject transport local address to a local pj_str_t variable. That
variable was ultimately used to set the Contact header's uri->host and the SDP
connection attribute's address again using pj_strassign. pj_strassign() doesn't
copy the actual value of the pj_str_t however, it just copies the pointer so
if a connection-oriented transport is disconnected before the 200 OK with the
SDP is sent, those pointers will be invalid which can cause use-after-free
issues. To prevent this, filter_on_tx_message() now uses pj_strdup with the
tdata->pool as the backing store to save the local IP address to the local
variable. pj_strassign() can then be used safely later on since the tdata
will be available for the life of the transaction.
ARI: Make ARI applications respect live_dangerously.
Author: George Joseph
Date: 2026-05-21
DeveloperNote: ARI applications can no longer call "dangerous" dialplan
functions like DB(), FILE(), SHELL(), CURL(), STAT(), etc. without
enabling "live_dangerously" in asterisk.conf.
res_rtp_asterisk.c: Address 2 potential T.140 RED buffer overruns.
Author: George Joseph
Date: 2026-04-27
Add check to red_t140_to_red() to ensure that the new primary payload
can't cause the rtp_red->len array items to wrap or cause an overrun of
the rtp_red->t140red_data buffer.
Add check to rtp_red_buffer() to ensure that a T.140 frame to be sent
can't cause rtp_red->len array items to wrap or cause an overrun of
the rtp_red->buf_data buffer.
res/res_pjsip_pubsub.c: Fix buffer over-read in MWI body parser
Author: Roberto Paleari
Date: 2026-04-29
Add constraint checks to prevent unauthenticated users from crashing Asterisk
instance by sending a crafted inbound SIP NOTIFY request with "Content-Type:
application/simple-message-summary".
app_sms: Bound protocol 1 SMS unpacking to fixed-size buffers
Author: Pengpeng Hou
Date: 2026-04-01
The protocol 1 unpack helpers trusted externally controlled lengths and wrote
them directly into fixed-size buffers in sms_t. Clamp the address, header,
and body copies to the destination array sizes so malformed messages cannot
overwrite adjacent state.
res_xmpp: Fix stack buffer overflow in namespace prefix handling
Author: Milan Kyselica
Date: 2026-03-26
The snprintf size parameter in xmpp_action_hook() is computed from
the attacker-controlled namespace prefix length and is not bounded
by the 256-byte stack buffer size. When a remote XMPP peer sends a
stanza with a child element whose namespace prefix exceeds 249
characters, snprintf writes past the buffer boundary.
Use sizeof(attr) as the snprintf size limit and %.*s precision to
extract only the prefix portion of the element name, preserving
the original truncation behavior for valid inputs.
res_pjsip_pubsub: Add width limit to sscanf in MWI NOTIFY parser
Author: Milan Kyselica
Date: 2026-03-24
The parse_simple_message_summary() function uses sscanf with an
unbounded %s format specifier to parse the Message-Account field
from incoming SIP NOTIFY bodies into a fixed-size 512-byte stack
buffer (PJSIP_MAX_URL_SIZE). A single unauthenticated SIP NOTIFY
with a Message-Account value exceeding 512 bytes overflows the
buffer, corrupting adjacent stack data and permanently disabling
the PJSIP transport layer without crashing the process.
Add a width specifier (%511s) to limit the sscanf write to
PJSIP_MAX_URL_SIZE - 1 bytes plus the NUL terminator, matching
the destination buffer size.
res_config_ldap: Escape LDAP filter values per RFC 4515
Author: Milan Kyselica
Date: 2026-03-23
The LDAP realtime driver constructs search filters by directly
concatenating user-supplied values without RFC 4515 escaping.
When LDAP is used as a realtime backend for endpoint
identification, characters with special meaning in LDAP filters
(*, (, ), ) can be injected via the SIP From header username.
Add ldap_filter_escape_value() that escapes RFC 4515 special
characters to their \HH hex representation, and apply it to
non-LIKE query values. The LIKE query path preserves the existing
wildcard conversion behavior with a note for maintainers.
cel_pgsql, cel_tds: Escape eventtype field to prevent SQL injection
Author: Milan Kyselica
Date: 2026-03-23
The eventtype column handler in cel_pgsql.c inserts
record.user_defined_name directly into the SQL query without
calling PQescapeStringConn(), while all other string fields in
the same function are properly escaped. Similarly, cel_tds.c
passes the raw user_defined_name into the SQL INSERT without
routing it through anti_injection(), while all other fields are
processed through that function.
For cel_pgsql.c, escape the eventtype value using
PQescapeStringConn(), matching the existing pattern used for all
other string fields at lines 308-331 of the same function.
For cel_tds.c, route the eventtype value through
anti_injection() consistent with how all other fields are handled
in the same function.
http: Escape error page text to prevent reflected XSS
Author: Milan Kyselica
Date: 2026-04-08
The text parameter in ast_http_create_response() is inserted into
the HTML body without escaping, while the server name on the same
page is properly escaped via ast_xml_escape(). When res_phoneprov
passes the decoded request URI as the text of a 404 response, HTML
metacharacters in the URI are rendered by the browser.
Apply ast_xml_escape() to the text parameter before inserting it
into the HTML template, using the same function already used for
the server name.
codec_codec2: Only process complete Codec2 frames in decoder
Author: Milan Kyselica
Date: 2026-04-08
The codec2_samples() function uses floor division (160 * datalen/6)
to compute expected output samples, but the decode loop condition
(x < datalen) iterates with ceiling behavior when datalen is not a
multiple of CODEC2_FRAME_LEN. This mismatch causes the loop to
decode one extra frame beyond what the framework bounds check
budgeted for, leading to an out-of-bounds write on the output buffer.
Change the loop condition to only process complete frames, matching
the floor-division behavior of codec2_samples(). This also prevents
an out-of-bounds read on the input side when fewer than
CODEC2_FRAME_LEN bytes remain.
format_ogg_speex: Add bounds check to prevent heap buffer overflow
Author: Milan Kyselica
Date: 2026-03-23
The ogg_speex_read() function copies OGG packet data via memcpy()
without validating the packet size against the destination buffer
(BUF_SIZE = 200 bytes). A crafted .spx file with an oversized OGG
audio packet causes a heap buffer overflow that corrupts the
adjacent speex_desc structure containing libogg heap pointers,
leading to a crash (SIGSEGV) on playback.
Add a bounds check for both negative and oversized values before
the memcpy, consistent with how format_ogg_vorbis bounds its reads
via ov_read().
Add uri prefix based acl support to the built in http server.
This allows an acl to be added per uri prefix (ie '/metrics'
or '/ws') to restrict access.
Add user based acl support for ARI. This adds new acl options
to the user section of ari.conf to restrict access on a per
user basis.
UserNote: A new section, type=restriction has been added to http.conf
to allow an uri prefix based acl to be configured. See
http.conf.sample for examples and more information.
The user section of ari.conf can now contain an acl configuration
to restrict users access. See ari.conf.sample for examples and more
information
build: Fix GCC discarded-qualifiers const errors.
Author: Joshua C. Colp
Date: 2026-02-12
GCC 15.2.1 pays attention to the discarding of the const
qualifier when strchr, strrchr, memchr, or memrchr are now
used. This change fixes numerous errors with this throughout
the tree. The fixes can be broken down into the following:
The return value should be considered const.
The value passed to strchr or strrchr can be cast as it is
expected and allowed to be modified.
The pointer passed to strchr or strrchr is not meant to be
modified and so the contents must be duplicated.
GHSA-vrfp-mg3q-3959: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
GHSA-wcvv-g26m-wx5c: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE
GHSA-x348-j6c9-77f3: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer
GHSA-xgj6-2gc5-5x9c: ast_loggrabber executes python script in world writable directory(/tmp) leading to potential privilege escalation And RCE
User Notes:
Upgrade Notes:
Developer Notes:
ARI: Make ARI applications respect live_dangerously.
ARI applications can no longer call "dangerous" dialplan
functions like DB(), FILE(), SHELL(), CURL(), STAT(), etc. without
enabling "live_dangerously" in asterisk.conf.
Resolves: #GHSA-vrfp-mg3q-3959
Commit Authors:
George Joseph: (6)
Mike Bradeen: (2)
Milan Kyselica: (7)
Pengpeng Hou: (1)
Roberto Paleari: (1)
ThatTotallyRealMyth: (1)
Issue and Commit Detail:
Closed Issues:
!GHSA-3g56-cgrh-95p5: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk
!GHSA-3rhj-hhw7-m6fw: NULL Pointer Dereference in HTTP AMI Digest Authentication
res_ari: Ensure read-only users are properly authorized via REST Over WebSocket.
Author: George Joseph
Date: 2026-06-12
The REST over WebSocket path now properly prevents non-GET methods from
being executed on inbound WebSockets.
The query parameters from the original incoming GET request that caused the
upgrade to WebSocket are now passed to all REST requests that come from the
client. This ensures that if the client authenticated with a read-only
userid using the "api_key" query_string parameter, REST requests coming
in over the WebSocket will only be able to execute GETs on resources.
The HTTP headers were already passed to the REST requests so if the
client had authenticated via an "Authorization" it was properly handled.
New tests have been added to test_ari.c to check that read-only users
are properly denied access to resources using non-GET methods. Several
memory leaks were also squashed.
pjsip_message_filter: Use pj_strdup instead of pj_strassign to save local address.
Author: George Joseph
Date: 2026-06-10
The filter_on_tx_message() function was using pj_strassign() to save the pointer
of the pjproject transport local address to a local pj_str_t variable. That
variable was ultimately used to set the Contact header's uri->host and the SDP
connection attribute's address again using pj_strassign. pj_strassign() doesn't
copy the actual value of the pj_str_t however, it just copies the pointer so
if a connection-oriented transport is disconnected before the 200 OK with the
SDP is sent, those pointers will be invalid which can cause use-after-free
issues. To prevent this, filter_on_tx_message() now uses pj_strdup with the
tdata->pool as the backing store to save the local IP address to the local
variable. pj_strassign() can then be used safely later on since the tdata
will be available for the life of the transaction.
ARI: Make ARI applications respect live_dangerously.
Author: George Joseph
Date: 2026-05-21
DeveloperNote: ARI applications can no longer call "dangerous" dialplan
functions like DB(), FILE(), SHELL(), CURL(), STAT(), etc. without
enabling "live_dangerously" in asterisk.conf.
res_rtp_asterisk.c: Address 2 potential T.140 RED buffer overruns.
Author: George Joseph
Date: 2026-04-27
Add check to red_t140_to_red() to ensure that the new primary payload
can't cause the rtp_red->len array items to wrap or cause an overrun of
the rtp_red->t140red_data buffer.
Add check to rtp_red_buffer() to ensure that a T.140 frame to be sent
can't cause rtp_red->len array items to wrap or cause an overrun of
the rtp_red->buf_data buffer.
res/res_pjsip_pubsub.c: Fix buffer over-read in MWI body parser
Author: Roberto Paleari
Date: 2026-04-29
Add constraint checks to prevent unauthenticated users from crashing Asterisk
instance by sending a crafted inbound SIP NOTIFY request with "Content-Type:
application/simple-message-summary".
app_sms: Bound protocol 1 SMS unpacking to fixed-size buffers
Author: Pengpeng Hou
Date: 2026-04-01
The protocol 1 unpack helpers trusted externally controlled lengths and wrote
them directly into fixed-size buffers in sms_t. Clamp the address, header,
and body copies to the destination array sizes so malformed messages cannot
overwrite adjacent state.
res_xmpp: Fix stack buffer overflow in namespace prefix handling
Author: Milan Kyselica
Date: 2026-03-26
The snprintf size parameter in xmpp_action_hook() is computed from
the attacker-controlled namespace prefix length and is not bounded
by the 256-byte stack buffer size. When a remote XMPP peer sends a
stanza with a child element whose namespace prefix exceeds 249
characters, snprintf writes past the buffer boundary.
Use sizeof(attr) as the snprintf size limit and %.*s precision to
extract only the prefix portion of the element name, preserving
the original truncation behavior for valid inputs.
res_pjsip_pubsub: Add width limit to sscanf in MWI NOTIFY parser
Author: Milan Kyselica
Date: 2026-03-24
The parse_simple_message_summary() function uses sscanf with an
unbounded %s format specifier to parse the Message-Account field
from incoming SIP NOTIFY bodies into a fixed-size 512-byte stack
buffer (PJSIP_MAX_URL_SIZE). A single unauthenticated SIP NOTIFY
with a Message-Account value exceeding 512 bytes overflows the
buffer, corrupting adjacent stack data and permanently disabling
the PJSIP transport layer without crashing the process.
Add a width specifier (%511s) to limit the sscanf write to
PJSIP_MAX_URL_SIZE - 1 bytes plus the NUL terminator, matching
the destination buffer size.
res_config_ldap: Escape LDAP filter values per RFC 4515
Author: Milan Kyselica
Date: 2026-03-23
The LDAP realtime driver constructs search filters by directly
concatenating user-supplied values without RFC 4515 escaping.
When LDAP is used as a realtime backend for endpoint
identification, characters with special meaning in LDAP filters
(*, (, ), ) can be injected via the SIP From header username.
Add ldap_filter_escape_value() that escapes RFC 4515 special
characters to their \HH hex representation, and apply it to
non-LIKE query values. The LIKE query path preserves the existing
wildcard conversion behavior with a note for maintainers.
cel_pgsql, cel_tds: Escape eventtype field to prevent SQL injection
Author: Milan Kyselica
Date: 2026-03-23
The eventtype column handler in cel_pgsql.c inserts
record.user_defined_name directly into the SQL query without
calling PQescapeStringConn(), while all other string fields in
the same function are properly escaped. Similarly, cel_tds.c
passes the raw user_defined_name into the SQL INSERT without
routing it through anti_injection(), while all other fields are
processed through that function.
For cel_pgsql.c, escape the eventtype value using
PQescapeStringConn(), matching the existing pattern used for all
other string fields at lines 308-331 of the same function.
For cel_tds.c, route the eventtype value through
anti_injection() consistent with how all other fields are handled
in the same function.
http: Escape error page text to prevent reflected XSS
Author: Milan Kyselica
Date: 2026-04-08
The text parameter in ast_http_create_response() is inserted into
the HTML body without escaping, while the server name on the same
page is properly escaped via ast_xml_escape(). When res_phoneprov
passes the decoded request URI as the text of a 404 response, HTML
metacharacters in the URI are rendered by the browser.
Apply ast_xml_escape() to the text parameter before inserting it
into the HTML template, using the same function already used for
the server name.
codec_codec2: Only process complete Codec2 frames in decoder
Author: Milan Kyselica
Date: 2026-04-08
The codec2_samples() function uses floor division (160 * datalen/6)
to compute expected output samples, but the decode loop condition
(x < datalen) iterates with ceiling behavior when datalen is not a
multiple of CODEC2_FRAME_LEN. This mismatch causes the loop to
decode one extra frame beyond what the framework bounds check
budgeted for, leading to an out-of-bounds write on the output buffer.
Change the loop condition to only process complete frames, matching
the floor-division behavior of codec2_samples(). This also prevents
an out-of-bounds read on the input side when fewer than
CODEC2_FRAME_LEN bytes remain.
format_ogg_speex: Add bounds check to prevent heap buffer overflow
Author: Milan Kyselica
Date: 2026-03-23
The ogg_speex_read() function copies OGG packet data via memcpy()
without validating the packet size against the destination buffer
(BUF_SIZE = 200 bytes). A crafted .spx file with an oversized OGG
audio packet causes a heap buffer overflow that corrupts the
adjacent speex_desc structure containing libogg heap pointers,
leading to a crash (SIGSEGV) on playback.
Add a bounds check for both negative and oversized values before
the memcpy, consistent with how format_ogg_vorbis bounds its reads
via ov_read().
GHSA-vrfp-mg3q-3959: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
GHSA-wcvv-g26m-wx5c: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE
GHSA-x348-j6c9-77f3: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer
GHSA-xgj6-2gc5-5x9c: ast_loggrabber executes python script in world writable directory(/tmp) leading to potential privilege escalation And RCE
User Notes:
acl: Add ACL support to http and ari
A new section, type=restriction has been added to http.conf
to allow an uri prefix based acl to be configured. See
http.conf.sample for examples and more information.
The user section of ari.conf can now contain an acl configuration
to restrict users access. See ari.conf.sample for examples and more
information
Upgrade Notes:
Developer Notes:
ARI: Make ARI applications respect live_dangerously.
ARI applications can no longer call "dangerous" dialplan
functions like DB(), FILE(), SHELL(), CURL(), STAT(), etc. without
enabling "live_dangerously" in asterisk.conf.
Resolves: #GHSA-vrfp-mg3q-3959
Commit Authors:
George Joseph: (6)
Joshua C. Colp: (1)
Mike Bradeen: (4)
Milan Kyselica: (7)
Pengpeng Hou: (1)
Roberto Paleari: (1)
ThatTotallyRealMyth: (1)
Issue and Commit Detail:
Closed Issues:
!GHSA-3g56-cgrh-95p5: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk
!GHSA-3rhj-hhw7-m6fw: NULL Pointer Dereference in HTTP AMI Digest Authentication
res_ari: Ensure read-only users are properly authorized via REST Over WebSocket.
Author: George Joseph
Date: 2026-06-12
The REST over WebSocket path now properly prevents non-GET methods from
being executed on inbound WebSockets.
The query parameters from the original incoming GET request that caused the
upgrade to WebSocket are now passed to all REST requests that come from the
client. This ensures that if the client authenticated with a read-only
userid using the "api_key" query_string parameter, REST requests coming
in over the WebSocket will only be able to execute GETs on resources.
The HTTP headers were already passed to the REST requests so if the
client had authenticated via an "Authorization" it was properly handled.
New tests have been added to test_ari.c to check that read-only users
are properly denied access to resources using non-GET methods. Several
memory leaks were also squashed.
pjsip_message_filter: Use pj_strdup instead of pj_strassign to save local address.
Author: George Joseph
Date: 2026-06-10
The filter_on_tx_message() function was using pj_strassign() to save the pointer
of the pjproject transport local address to a local pj_str_t variable. That
variable was ultimately used to set the Contact header's uri->host and the SDP
connection attribute's address again using pj_strassign. pj_strassign() doesn't
copy the actual value of the pj_str_t however, it just copies the pointer so
if a connection-oriented transport is disconnected before the 200 OK with the
SDP is sent, those pointers will be invalid which can cause use-after-free
issues. To prevent this, filter_on_tx_message() now uses pj_strdup with the
tdata->pool as the backing store to save the local IP address to the local
variable. pj_strassign() can then be used safely later on since the tdata
will be available for the life of the transaction.
ARI: Make ARI applications respect live_dangerously.
Author: George Joseph
Date: 2026-05-21
DeveloperNote: ARI applications can no longer call "dangerous" dialplan
functions like DB(), FILE(), SHELL(), CURL(), STAT(), etc. without
enabling "live_dangerously" in asterisk.conf.
res_rtp_asterisk.c: Address 2 potential T.140 RED buffer overruns.
Author: George Joseph
Date: 2026-04-27
Add check to red_t140_to_red() to ensure that the new primary payload
can't cause the rtp_red->len array items to wrap or cause an overrun of
the rtp_red->t140red_data buffer.
Add check to rtp_red_buffer() to ensure that a T.140 frame to be sent
can't cause rtp_red->len array items to wrap or cause an overrun of
the rtp_red->buf_data buffer.
res/res_pjsip_pubsub.c: Fix buffer over-read in MWI body parser
Author: Roberto Paleari
Date: 2026-04-29
Add constraint checks to prevent unauthenticated users from crashing Asterisk
instance by sending a crafted inbound SIP NOTIFY request with "Content-Type:
application/simple-message-summary".
app_sms: Bound protocol 1 SMS unpacking to fixed-size buffers
Author: Pengpeng Hou
Date: 2026-04-01
The protocol 1 unpack helpers trusted externally controlled lengths and wrote
them directly into fixed-size buffers in sms_t. Clamp the address, header,
and body copies to the destination array sizes so malformed messages cannot
overwrite adjacent state.
res_xmpp: Fix stack buffer overflow in namespace prefix handling
Author: Milan Kyselica
Date: 2026-03-26
The snprintf size parameter in xmpp_action_hook() is computed from
the attacker-controlled namespace prefix length and is not bounded
by the 256-byte stack buffer size. When a remote XMPP peer sends a
stanza with a child element whose namespace prefix exceeds 249
characters, snprintf writes past the buffer boundary.
Use sizeof(attr) as the snprintf size limit and %.*s precision to
extract only the prefix portion of the element name, preserving
the original truncation behavior for valid inputs.
res_pjsip_pubsub: Add width limit to sscanf in MWI NOTIFY parser
Author: Milan Kyselica
Date: 2026-03-24
The parse_simple_message_summary() function uses sscanf with an
unbounded %s format specifier to parse the Message-Account field
from incoming SIP NOTIFY bodies into a fixed-size 512-byte stack
buffer (PJSIP_MAX_URL_SIZE). A single unauthenticated SIP NOTIFY
with a Message-Account value exceeding 512 bytes overflows the
buffer, corrupting adjacent stack data and permanently disabling
the PJSIP transport layer without crashing the process.
Add a width specifier (%511s) to limit the sscanf write to
PJSIP_MAX_URL_SIZE - 1 bytes plus the NUL terminator, matching
the destination buffer size.
res_config_ldap: Escape LDAP filter values per RFC 4515
Author: Milan Kyselica
Date: 2026-03-23
The LDAP realtime driver constructs search filters by directly
concatenating user-supplied values without RFC 4515 escaping.
When LDAP is used as a realtime backend for endpoint
identification, characters with special meaning in LDAP filters
(*, (, ), ) can be injected via the SIP From header username.
Add ldap_filter_escape_value() that escapes RFC 4515 special
characters to their \HH hex representation, and apply it to
non-LIKE query values. The LIKE query path preserves the existing
wildcard conversion behavior with a note for maintainers.
cel_pgsql, cel_tds: Escape eventtype field to prevent SQL injection
Author: Milan Kyselica
Date: 2026-03-23
The eventtype column handler in cel_pgsql.c inserts
record.user_defined_name directly into the SQL query without
calling PQescapeStringConn(), while all other string fields in
the same function are properly escaped. Similarly, cel_tds.c
passes the raw user_defined_name into the SQL INSERT without
routing it through anti_injection(), while all other fields are
processed through that function.
For cel_pgsql.c, escape the eventtype value using
PQescapeStringConn(), matching the existing pattern used for all
other string fields at lines 308-331 of the same function.
For cel_tds.c, route the eventtype value through
anti_injection() consistent with how all other fields are handled
in the same function.
http: Escape error page text to prevent reflected XSS
Author: Milan Kyselica
Date: 2026-04-08
The text parameter in ast_http_create_response() is inserted into
the HTML body without escaping, while the server name on the same
page is properly escaped via ast_xml_escape(). When res_phoneprov
passes the decoded request URI as the text of a 404 response, HTML
metacharacters in the URI are rendered by the browser.
Apply ast_xml_escape() to the text parameter before inserting it
into the HTML template, using the same function already used for
the server name.
codec_codec2: Only process complete Codec2 frames in decoder
Author: Milan Kyselica
Date: 2026-04-08
The codec2_samples() function uses floor division (160 * datalen/6)
to compute expected output samples, but the decode loop condition
(x < datalen) iterates with ceiling behavior when datalen is not a
multiple of CODEC2_FRAME_LEN. This mismatch causes the loop to
decode one extra frame beyond what the framework bounds check
budgeted for, leading to an out-of-bounds write on the output buffer.
Change the loop condition to only process complete frames, matching
the floor-division behavior of codec2_samples(). This also prevents
an out-of-bounds read on the input side when fewer than
CODEC2_FRAME_LEN bytes remain.
format_ogg_speex: Add bounds check to prevent heap buffer overflow
Author: Milan Kyselica
Date: 2026-03-23
The ogg_speex_read() function copies OGG packet data via memcpy()
without validating the packet size against the destination buffer
(BUF_SIZE = 200 bytes). A crafted .spx file with an oversized OGG
audio packet causes a heap buffer overflow that corrupts the
adjacent speex_desc structure containing libogg heap pointers,
leading to a crash (SIGSEGV) on playback.
Add a bounds check for both negative and oversized values before
the memcpy, consistent with how format_ogg_vorbis bounds its reads
via ov_read().
Add uri prefix based acl support to the built in http server.
This allows an acl to be added per uri prefix (ie '/metrics'
or '/ws') to restrict access.
Add user based acl support for ARI. This adds new acl options
to the user section of ari.conf to restrict access on a per
user basis.
UserNote: A new section, type=restriction has been added to http.conf
to allow an uri prefix based acl to be configured. See
http.conf.sample for examples and more information.
The user section of ari.conf can now contain an acl configuration
to restrict users access. See ari.conf.sample for examples and more
information
build: Fix GCC discarded-qualifiers const errors.
Author: Joshua C. Colp
Date: 2026-02-12
GCC 15.2.1 pays attention to the discarding of the const
qualifier when strchr, strrchr, memchr, or memrchr are now
used. This change fixes numerous errors with this throughout
the tree. The fixes can be broken down into the following:
The return value should be considered const.
The value passed to strchr or strrchr can be cast as it is
expected and allowed to be modified.
The pointer passed to strchr or strrchr is not meant to be
modified and so the contents must be duplicated.
GHSA-vrfp-mg3q-3959: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
GHSA-x348-j6c9-77f3: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer
GHSA-xgj6-2gc5-5x9c: ast_loggrabber executes python script in world writable directory(/tmp) leading to potential privilege escalation And RCE
User Notes:
Upgrade Notes:
Developer Notes:
ARI: Make ARI applications respect live_dangerously.
ARI applications can no longer call "dangerous" dialplan
functions like DB(), FILE(), SHELL(), CURL(), STAT(), etc. without
enabling "live_dangerously" in asterisk.conf.
Resolves: #GHSA-vrfp-mg3q-3959
Commit Authors:
George Joseph: (5)
Joshua C. Colp: (1)
Mike Bradeen: (2)
Milan Kyselica: (7)
Pengpeng Hou: (1)
Roberto Paleari: (1)
ThatTotallyRealMyth: (1)
Issue and Commit Detail:
Closed Issues:
!GHSA-3g56-cgrh-95p5: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk
!GHSA-3rhj-hhw7-m6fw: NULL Pointer Dereference in HTTP AMI Digest Authentication
pjsip_message_filter: Use pj_strdup instead of pj_strassign to save local address.
Author: George Joseph
Date: 2026-06-10
The filter_on_tx_message() function was using pj_strassign() to save the pointer
of the pjproject transport local address to a local pj_str_t variable. That
variable was ultimately used to set the Contact header's uri->host and the SDP
connection attribute's address again using pj_strassign. pj_strassign() doesn't
copy the actual value of the pj_str_t however, it just copies the pointer so
if a connection-oriented transport is disconnected before the 200 OK with the
SDP is sent, those pointers will be invalid which can cause use-after-free
issues. To prevent this, filter_on_tx_message() now uses pj_strdup with the
tdata->pool as the backing store to save the local IP address to the local
variable. pj_strassign() can then be used safely later on since the tdata
will be available for the life of the transaction.
ARI: Make ARI applications respect live_dangerously.
Author: George Joseph
Date: 2026-05-21
DeveloperNote: ARI applications can no longer call "dangerous" dialplan
functions like DB(), FILE(), SHELL(), CURL(), STAT(), etc. without
enabling "live_dangerously" in asterisk.conf.
res_rtp_asterisk.c: Address 2 potential T.140 RED buffer overruns.
Author: George Joseph
Date: 2026-04-27
Add check to red_t140_to_red() to ensure that the new primary payload
can't cause the rtp_red->len array items to wrap or cause an overrun of
the rtp_red->t140red_data buffer.
Add check to rtp_red_buffer() to ensure that a T.140 frame to be sent
can't cause rtp_red->len array items to wrap or cause an overrun of
the rtp_red->buf_data buffer.
res/res_pjsip_pubsub.c: Fix buffer over-read in MWI body parser
Author: Roberto Paleari
Date: 2026-04-29
Add constraint checks to prevent unauthenticated users from crashing Asterisk
instance by sending a crafted inbound SIP NOTIFY request with "Content-Type:
application/simple-message-summary".
app_sms: Bound protocol 1 SMS unpacking to fixed-size buffers
Author: Pengpeng Hou
Date: 2026-04-01
The protocol 1 unpack helpers trusted externally controlled lengths and wrote
them directly into fixed-size buffers in sms_t. Clamp the address, header,
and body copies to the destination array sizes so malformed messages cannot
overwrite adjacent state.
res_xmpp: Fix stack buffer overflow in namespace prefix handling
Author: Milan Kyselica
Date: 2026-03-26
The snprintf size parameter in xmpp_action_hook() is computed from
the attacker-controlled namespace prefix length and is not bounded
by the 256-byte stack buffer size. When a remote XMPP peer sends a
stanza with a child element whose namespace prefix exceeds 249
characters, snprintf writes past the buffer boundary.
Use sizeof(attr) as the snprintf size limit and %.*s precision to
extract only the prefix portion of the element name, preserving
the original truncation behavior for valid inputs.
res_pjsip_pubsub: Add width limit to sscanf in MWI NOTIFY parser
Author: Milan Kyselica
Date: 2026-03-24
The parse_simple_message_summary() function uses sscanf with an
unbounded %s format specifier to parse the Message-Account field
from incoming SIP NOTIFY bodies into a fixed-size 512-byte stack
buffer (PJSIP_MAX_URL_SIZE). A single unauthenticated SIP NOTIFY
with a Message-Account value exceeding 512 bytes overflows the
buffer, corrupting adjacent stack data and permanently disabling
the PJSIP transport layer without crashing the process.
Add a width specifier (%511s) to limit the sscanf write to
PJSIP_MAX_URL_SIZE - 1 bytes plus the NUL terminator, matching
the destination buffer size.
res_config_ldap: Escape LDAP filter values per RFC 4515
Author: Milan Kyselica
Date: 2026-03-23
The LDAP realtime driver constructs search filters by directly
concatenating user-supplied values without RFC 4515 escaping.
When LDAP is used as a realtime backend for endpoint
identification, characters with special meaning in LDAP filters
(*, (, ), ) can be injected via the SIP From header username.
Add ldap_filter_escape_value() that escapes RFC 4515 special
characters to their \HH hex representation, and apply it to
non-LIKE query values. The LIKE query path preserves the existing
wildcard conversion behavior with a note for maintainers.
cel_pgsql, cel_tds: Escape eventtype field to prevent SQL injection
Author: Milan Kyselica
Date: 2026-03-23
The eventtype column handler in cel_pgsql.c inserts
record.user_defined_name directly into the SQL query without
calling PQescapeStringConn(), while all other string fields in
the same function are properly escaped. Similarly, cel_tds.c
passes the raw user_defined_name into the SQL INSERT without
routing it through anti_injection(), while all other fields are
processed through that function.
For cel_pgsql.c, escape the eventtype value using
PQescapeStringConn(), matching the existing pattern used for all
other string fields at lines 308-331 of the same function.
For cel_tds.c, route the eventtype value through
anti_injection() consistent with how all other fields are handled
in the same function.
http: Escape error page text to prevent reflected XSS
Author: Milan Kyselica
Date: 2026-04-08
The text parameter in ast_http_create_response() is inserted into
the HTML body without escaping, while the server name on the same
page is properly escaped via ast_xml_escape(). When res_phoneprov
passes the decoded request URI as the text of a 404 response, HTML
metacharacters in the URI are rendered by the browser.
Apply ast_xml_escape() to the text parameter before inserting it
into the HTML template, using the same function already used for
the server name.
codec_codec2: Only process complete Codec2 frames in decoder
Author: Milan Kyselica
Date: 2026-04-08
The codec2_samples() function uses floor division (160 * datalen/6)
to compute expected output samples, but the decode loop condition
(x < datalen) iterates with ceiling behavior when datalen is not a
multiple of CODEC2_FRAME_LEN. This mismatch causes the loop to
decode one extra frame beyond what the framework bounds check
budgeted for, leading to an out-of-bounds write on the output buffer.
Change the loop condition to only process complete frames, matching
the floor-division behavior of codec2_samples(). This also prevents
an out-of-bounds read on the input side when fewer than
CODEC2_FRAME_LEN bytes remain.
format_ogg_speex: Add bounds check to prevent heap buffer overflow
Author: Milan Kyselica
Date: 2026-03-23
The ogg_speex_read() function copies OGG packet data via memcpy()
without validating the packet size against the destination buffer
(BUF_SIZE = 200 bytes). A crafted .spx file with an oversized OGG
audio packet causes a heap buffer overflow that corrupts the
adjacent speex_desc structure containing libogg heap pointers,
leading to a crash (SIGSEGV) on playback.
Add a bounds check for both negative and oversized values before
the memcpy, consistent with how format_ogg_vorbis bounds its reads
via ov_read().
GCC 15.2.1 pays attention to the discarding of the const
qualifier when strchr, strrchr, memchr, or memrchr are now
used. This change fixes numerous errors with this throughout
the tree. The fixes can be broken down into the following:
The return value should be considered const.
The value passed to strchr or strrchr can be cast as it is
expected and allowed to be modified.
The pointer passed to strchr or strrchr is not meant to be
modified and so the contents must be duplicated.
If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.
Added
Encryption-at-rest: Support for AES-256-GCM and ChaCha20-Poly1305 for S/MIME (#161).
S3: Support for allowInvalidCerts option to allow connecting to S3 endpoints with invalid TLS certificates.
Redis Sentinel support as an in-memory store and cluster coordinator backend (#2430).
Changed
Fixed
DANE: Verify DNSSEC is supported by the resolver before attempting to validate TLSA records.
TLS: Update search index when file-backed certificates are refreshed.
JMAP: Principal/query returns broad results when a name or email filter cannot be resolved.
Webhooks: event IDs collide for same event type emitted in the same second.
njs-1.0.0
version has been
released,
deprecating the
njs
engine in favor of QuickJS,
aligning exception classes between the engines,
and hardening
ngx.fetch()
request validation.
If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.
The new version includes changes aiming at improving the defenses of the software against potential HTTP/2 BOMB attacks. It also includes several enhancements.
This release addresses five low-impact problems that need to be addressed as they can reduce safety margins.
In addition to updated releases for the supported Postfix versions 3.8-3.11, patches will also be available at the Postfix source mirror sites for the out-of-support Postfix versions 2.9-3.7:
These patches come with the same PGP, GPG1 and GPG2 signatures as Postfix release tarballs and patches.
Fixed in Postfix 3.8-3.11:
Bug 1 (defect introduced: Postfix 3.1, date 20150607): null pointer read and heap data overread in the Postfix SMTP client's smtp_dns_reply_filter. Problem reported by TristanInSec, found with ASAN. Also reported by other people. Reproduction and real-world impact researched by Wietse.
Root cause for bug 1:
A missing 'break' statement after the code that converts a TLSA record to string.
Reproduction for bug 1:
The problem happens when smtp_dns_reply_filter is configured (this is disabled by default); the Postfix SMTP client is configured to use opportunistic or mandatory DANE authentication (this is disabled by default); the destination domain publishes a TLSA record that is empty or shorter than 20 bytes; and the OS is configured to use a resolver that passes such a TLSA record. For example, a zero-length TLSA record is blocked by BIND, Google DNS, OpenDNS, and by configurations that use systemd-resolved (the default on many LINUX systems); it is passed by Cloudflare, Quad9 DNS, and unbound, as long as these resolvers are used without systemd-resolved.
Impact statement for bug 1:
SMTP client termination with a null pointer read crash when the TLSA record length is zero; or an SMTP client data overread (or rarely, SMTP client termination with a read segfault crash) when 0 < record length < 20 bytes. The overread content is not disclosed.
Performance impact of bugs 1 and 2:
The impact of SMTP client crashes (voluntary or not) is easily overstated. That said, crashes must be eliminated regardless of their impact.
On systems that deliver fewer than one message per minute, an SMTP client crash can result in a delay of up to one minute for email delivery to other destination domains.
On systems with a larger traffic volume, the impact of an SMTP client crash on deliveries to other destination domains is minor because Postfix reuses SMTP client processes and replaces a failed process within seconds (self-healing); the practical impact is believed to be no worse than that of an uncooperative receiver that tarpits SMTP connections from Postfix to one or more destination domains under their control (by replying within Postfix SMTP client read time limits which are several minutes by default).
Bug 2 (defect introduced: Postfix 3.6, date: 20200710): panic (assertion failure and voluntary crash) while parsing a TLSA reply with length 3. Found during code maintenance. See below for root cause, reproduction, and impact.
Root cause for bug 2:
An incorrect test 'length < 3' instead of 'length <= 3' causes a safety check to fail when a TLSA parser attempts to create zero-length storage for a non-existent TLSA certificate association data field.
Reproduction for bug 2:
The problem happens when the Postfix SMTP client is configured to use opportunistic or mandatory DANE authentication (this is disabled by default); a destination domain publishes a TLSA record with a length of three bytes; and the OS is configured to use a resolver that passes such a TLSA record. For example, a length-three TLSA record is blocked by BIND, and by configurations that use systemd-resolved (the default on many LINUX systems). It is passed by many other resolvers.
Bug 2 enables an attack that is more potent than bug 1.
An attack with a length-three TLSA reply does not depend on smtp_dns_reply_filter configuration.
An attack with a length-three TLSA reply propagates through more resolvers than an attack with a length-zero TLSA reply.
Impact statement for bug 2:
SMTP client voluntary termination (crash) after an assertion failure. This is a fail-safe mechanism.
See also above for "Performance impact of bugs 1 and 2".
Bug 3 (Problem introduced: Postfix 2.9, date: 20110205) Robustness: the Postfix SMTP server will no longer receive (and discard) an unlimited amount of text while receiving a long SMTP command line. Problem reported by Michael Wollner (Ibonok). Under high load conditions, the amount of text was already limited by a 10-second deadline to receive an SMTP command.
Bug 4 Robustness: with the above change the Postfix SMTP client will no longer receive (and discard) an unlimited amount of text while receiving a long SMTP response line.
Bug 5 (Problem introduced: Postfix 3.4, date: 20180825) Robustness: do not receive (and discard) unlimited amounts of data with BDAT commands. Problem found during code maintenance. File: smtpd/smtpd.c.
Impact statement for bugs 3, 4, 5:
Postfix should not receive and discard unlimited amounts of input in SMTP command lines or BDAT chunks, but fixing that will not fundamentally change the situation.
By design, any SMTP client can force a server to receive (and discard) an unlimited amount of text.
For example, an attacker can repeatedly send messages that are a little under the server's message size limit and abort each transaction a before reaching the message end. When sending a message with the "DATA" command, an attacker would disconnect instead of sending <CR><LF>.<CR><LF>; and when sending a message with the "BDAT" command, an attacker would send "RSET" instead of "BDAT LAST".
To mitigate such abuse, Postfix can rate-limit the number of message transactions from the same IP address or address range (see smtpd_client_message_rate_limit and *prefix_length parameters). Such a defense is ineffective when faced with a distributed attack (botnet); for that, postscreen combined with an IP reputation service (DNSBL) may be more effective.
nginx-1.30.3
stable and
nginx-1.31.2
mainline versions have been released,
with fixes for
buffer overflow
vulnerability in the ngx_http_proxy_v2_module
and ngx_http_grpc_module (CVE-2026-42055), and
buffer overread
vulnerability in the ngx_http_charset_module (CVE-2026-48142).
Additionally, nginx-1.31.2
includes a fix for
use-after-free
vulnerability in the ngx_http_v3_module (CVE-2026-42530).
If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.
Added
ACME: Allow specifying a preferred certificate chain.
Changed
Fixed
JMAP: */changes methods leak ids of non-shared objects (reported by @5ud0er).
Sieve: Do not allow invalid certs in http_header function.
FoundationDB: Fix read version cache expiration logic.
MTA: Re-scheduling or editing a queued message reports success but persists nothing for recipients in a non-default virtual queue.
CardDAV: Version requests included in address-data are ignored.
ACME: Add freshness check when renewing certificates.
Autodiscover v2: Read email address from query parameters.
Sieve: Do not keep copies of redirected messages when keep is not specified.
support using regexp groups in every part of a source URL (#5766) (#5779)
improve anti-brute force mechanism (#5835) delay authentication failure responses by a random amount of time, use the same anti-brute force mechanism with all users.
limit size of HTTP requests shown in debug logs (#5858)
print body of selected HTTP responses when log level is debug (#5859)
Media-over-QUIC
fix race condition when closing server (#5836) some sessions were hanging if they were concurrently being closed by the remote peer.
rename moqHTTPS2Address into moqHTTP2Address, moqHTTPS3Address into moqHTTP3Address (#5841)
RTSP
support PROXY protocol (#5754) Support PROXY protocol v1/v2 on RTMP, RTMPS, RTSP, and RTSPS TCP listeners so real client IPs are visible when running behind L4 proxies (nginx stream, HAProxy, AWS NLB).
restore support for H264 packetization-mode 0 (#5846) (#5857) H264 streams with packetization-mode=0 cannot be routed with UDP since packets are too big. Inbound streams with packetization-mode=0 are blocked by the server since v1.19.0 but this caused compatibility issues with some cameras. The server is now able to receive such streams with TCP, and automatically remuxes them in streams with packetization-mode=1, which can be routed freely.
RTMP
support PROXY protocol (#5754) Support PROXY protocol v1/v2 on RTMP, RTMPS, RTSP, and RTSPS TCP listeners so real client IPs are visible when running behind L4 proxies (nginx stream, HAProxy, AWS NLB).
Dependencies
code.cloudfoundry.org/bytefmt updated from v0.74.0 to v0.76.0
github.com/bluenviron/gortsplib/v5 updated from v5.5.4 to v5.6.0
github.com/pion/ice/v4 updated from v4.2.7 to v4.2.8-0.20260604162030-72f5001c4596
github.com/pion/webrtc/v4 updated from v4.2.14 to v4.2.15
github.com/quic-go/quic-go updated from v0.59.0 to v0.60.0
golang.org/x/crypto updated from v0.52.0 to v0.53.0
golang.org/x/net updated from v0.55.0 to v0.56.0
golang.org/x/sync updated from v0.20.0 to v0.21.0
golang.org/x/sys updated from v0.45.0 to v0.46.0
golang.org/x/term updated from v0.43.0 to v0.44.0
github.com/pion/dtls/v3 updated from v3.1.3 to v3.1.4
github.com/pion/stun/v3 updated from v3.1.4 to v3.1.5
github.com/pion/turn/v5 updated from v5.0.7 to v5.0.9
golang.org/x/text updated from v0.37.0 to v0.38.0
github.com/pires/go-proxyproto v0.12.0 added
Security
Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.
Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:
ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx
You can verify checksums of binaries by downloading checksums.sha256 and running:
If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.
Added
Changed
OAuth: Rework access tokens to an AES-256-GCM-SIV AEAD format that carries the account name for proxy routing.
Added more internal TLDs to the domain validation.
Fixed
MTA:
Sub-addressing with external directories returns 550 Mailbox not found.
Disabled aliases continue receiving messages.
JMAP for File Storage: FileNode/get returns a stale state string.
Make SieveSystemInterpreter.defaultReturnPath and MtaQueueQuota.match optional expressions.
Rate limiter panics when periods under 1 second are used.
CalDAV/CardDAV: Calendar events, contacts, calendars and address books deleted via JMAP do not write a vanished tombstone.
The PostgreSQL Global Development Group announces that the first beta release of
PostgreSQL 19 is now available for download.
This release contains PostgreSQL 19 feature previews ahead of general
availability, though some details of the release can change during the beta
period.
You can find information about all of the PostgreSQL 19 features and changes in
the release notes:
In the spirit of the open source PostgreSQL community, we strongly encourage you
to test the new features of PostgreSQL 19 on your systems to help us eliminate
bugs and other issues. While we do not advise you to run beta versions in
production environments, we encourage you to find ways to run your typical
application workloads against this beta release.
Your testing and feedback help the community ensure that PostgreSQL 19
upholds our standards of delivering a stable, reliable release of the
world's most advanced open source relational database. Please read more about
our beta testing process and how
you can contribute:
Below are some of the feature highlights that are planned for PostgreSQL 19.
This list is not exhaustive; for the full list of planned features, please see
the release notes.
Performance
PostgreSQL 19 builds on the asynchronous I/O subsystem introduced in
PostgreSQL 18. In this release, io_method=worker now automatically scales the
number of I/O workers based on the new
io_min_workers
and
io_max_workers
settings.
This release also introduces the
pg_plan_advice
extension, which lets users stabilize and control planner decisions, along with
pg_stash_advice
to apply advice automatically using query identifiers.
This release brings improvements to vacuum and maintenance operations.
Autovacuum can now use parallel workers, which can be configured with the new
autovacuum_max_parallel_workers
setting, and a new autovacuum scoring system
helps prioritize tables to vacuum. PostgreSQL 19 further enhances vacuum with
a new strategy that can automatically reduce future vacuuming work by marking
pages as visible while they're being queried. Additionally, this release
adds the new REPACK
command and its nonblocking CONCURRENTLY
option, which allow tables to be rebuilt with less operational overhead.
PostgreSQL 19 shows up to 2x better performance on inserts when foreign key
checks are present. Additionally, this release improves several areas of
the query planner and executor, including new anti-join optimizations, broader
use of incremental sorts,
eager aggregation
that speeds up row processing,
faster reads from storage during parallel sequential scans, and
simplification of IS DISTINCT FROM
and IS NOT DISTINCT FROM to plain
<> and = operators when the inputs are not nullable. There are also
improvements for
LISTEN/NOTIFY
scalability that impact multi-channel workloads.
Developer Experience
PostgreSQL 19 introduces support for
SQL/PGQ,
letting users execute property graph queries using SQL standard syntax. This
release also expands temporal query capabilities with UPDATE and DELETE
support for the
FOR PORTION OF
clause, complementing the temporal constraint support added in
PostgreSQL 18. This release also adds
ALTER TABLE ... MERGE PARTITIONS
and ALTER TABLE ... SPLIT PARTITIONS to make it easier to reorganize
partitioned tables in place. There is now also support for returning rows that
conflict during an upsert operation using
INSERT ... ON CONFLICT DO SELECT ... RETURNING.
PostgreSQL 19 introduces the new
GROUP BY ALL
syntax, making it easy to add
all non-aggregate and non-window output columns as part of the grouping. This
release extends string processing capabilities in
jsonpath
with the addition of
lower(), upper(), initcap(), replace(), split_part(), and the trim()
family of functions.
PostgreSQL 19 makes it easier to adopt "read-your-writes" query patterns
when working with replicas using the new
WAIT FOR LSN
command. This lets a
session wait until changes up to a specific log position (LSN) have been
replayed on the replica before executing a SELECT query.
PostgreSQL 19 also adds new SQL functions to retrieve the
DDL statements
needed to recreate roles, tablespaces, and databases, simplifying
scripting and migration tasks. Additionally, the
random()
function now works
with date and timestamp types, and
PL/Python
now supports event triggers.
Security Features
PostgreSQL 19 adds server-side support for Server Name Indication (SNI) through
a new
pg_hosts.conf
file, allowing a single PostgreSQL server to present
different TLS certificates based on the hostname requested by the client. There
is also a new
password_expiration_warning_threshold
setting (defaulting to 7 days) to warn users in advance of upcoming password
expirations.
Further to the ongoing deprecation efforts of
md5 authentication,
this release
issues a warning to the client after a successful md5 authentication. This is
controllable via the new
md5_password_warnings
setting.
Monitoring and Observability
PostgreSQL 19 introduces the
pg_stat_lock
view, which reports per-lock-type
statistics, and
pg_stat_recovery
which provides detailed visibility into the
state of recovery operations. A stats_reset column is now available across
many statistics views to show when counters were last cleared. The
pg_stat_progress_vacuum
and
pg_stat_progress_analyze
views now include a
started_by column that reports the initiator of the operation, and
pg_stat_progress_vacuum also has a mode column that reports how vacuum
is operating.
This release also allows
log_min_messages
levels to be specified per process
type, giving operators finer control over what each part of the system logs.
Additionally, WAL full page write byte counts are now reported in
VACUUM and
ANALYZE log output,
helping identify maintenance operations that generate large amounts of WAL.
Additionally, EXPLAIN ANALYZE
now supports surfacing asynchronous I/O (AIO) statistics through its IO option,
providing better visibility into how queries are using the AIO subsystem.
Logical Replication and Query Federation
In PostgreSQL 19, logical replication now replicates sequence values,
simplifying tasks like online upgrades. Additionally, the new
CREATE PUBLICATION ... EXCEPT
syntax allows you to publish all tables in
a database except for a specified set, while
CREATE SUBSCRIPTION ... SERVER
allows subscriptions to be defined using a foreign server, simplifying
credential management.
PostgreSQL 19 makes it possible to enable logical replication without restarting
a server. Logical replication can now be enabled on demand even when
wal_level
is set to replica, and the new read-only
effective_wal_level
parameter reports the WAL level currently in effect. This reduces the need to
commit upfront to a higher WAL level for clusters that may only occasionally
need it, and avoids disrupting an active workload.
The PostgreSQL foreign data wrapper,
postgres_fdw,
used for query federation, includes several performance improvements, including
pushing down array operations to the remote server, and retrieving and using
statistics from foreign tables to support better local query planning.
Other Highlights
The PostgreSQL 19 beta period includes a temporary "grease mode"
to try to find protocol compatibility problems in the wider ecosystem. This wiki
page contains information on how the campaign works:
PostgreSQL 19 allows
data checksums
to be enabled or disabled online, without
requiring a cluster restart or reinitialization.
There are several notable changes to be aware of in
PostgreSQL 19.
Just-in-time compilation (JIT)
is now disabled by default,
and the
default_toast_compression
setting now defaults to lz4,
providing better default compression and decompression performance. Support for
RADIUS authentication is now removed. Additionally, the
vacuumdb --analyze-only
command by default analyzes partitioned tables.
Additional Features
Many other new features and improvements have been added to PostgreSQL 19. Many
of these may also be helpful for your use cases. Please see the
release notes for a
complete list of new and changed features:
The stability of each PostgreSQL release greatly depends on you, the community,
to test the upcoming version with your workloads and testing tools to find bugs
and regressions before the general availability of PostgreSQL 19. As this is a
Beta, minor changes to database behaviors, feature details, and APIs are still
possible. Your feedback and testing will help determine the final tweaks on the
new features, so please test in the near future. The quality of user testing
helps determine when we can make a final release.
A list of open issues
is publicly available in the PostgreSQL wiki. You can
report bugs using this form on
the PostgreSQL website:
This is the first beta release of version 19. The PostgreSQL Project will
release additional betas as required for testing, followed by one or more
release candidates, until the final release around September/October 2026. For further
information please see the Beta Testing
page.
support reading and publishing with Media-over-QUIC (#5815) Media-over-QUIC is a streaming protocol built upon cutting edge protocols (QUIC, HTTP3) and browser APIs (WebTransport, WebCodecs). It's slightly faster than WebRTC, has an advanced data recovery mechanism, it supports additional codecs (FLAC) and is less complicated to route. Check the documentation for instructions and details.
forbid H264 packetization mode zero (bluenviron/gortsplib#1072) Packetization mode zero requires allowing inefficient and brittle fragmented UDP packets, which we are not.
muxer: fix race condition when generating playlist (bluenviron/gohlslib#359) (bluenviron/gohlslib#360) Max age of playlist depends on segments, so it needs to be covered by the segment mutex.
code.cloudfoundry.org/bytefmt updated from v0.72.0 to v0.74.0
github.com/abema/go-mp4 updated from v1.5.0 to v1.6.0
github.com/bluenviron/gohlslib/v2 updated from v2.3.2 to v2.4.0
github.com/bluenviron/gortmplib updated from v0.3.2 to v0.4.0
github.com/bluenviron/gortsplib/v5 updated from v5.5.3 to v5.5.4
github.com/bluenviron/mediacommon/v2 updated from v2.8.3 to v2.9.0
github.com/go-git/go-git/v5 updated from v5.19.0 to v5.19.1
github.com/matthewhartstonge/argon2 updated from v1.5.3 to v1.5.4
github.com/pion/ice/v4 updated from v4.2.5 to v4.2.7
github.com/pion/transport/v4 updated from v4.0.1 to v4.0.2
github.com/pion/webrtc/v4 updated from v4.2.12 to v4.2.14
golang.org/x/crypto updated from v0.51.0 to v0.52.0
golang.org/x/net updated from v0.54.0 to v0.55.0
golang.org/x/sys updated from v0.44.0 to v0.45.0
github.com/pion/dtls/v3 updated from v3.1.2 to v3.1.3
github.com/pion/sctp updated from v1.9.5 to v1.10.0
github.com/pion/srtp/v3 updated from v3.0.10 to v3.0.11
github.com/pion/stun/v3 updated from v3.1.2 to v3.1.4
github.com/pion/turn/v5 updated from v5.0.3 to v5.0.7
github.com/quic-go/webtransport-go v0.10.0 added
golang.org/x/sync v0.20.0 added
github.com/dunglas/httpsfv v1.1.0 added
github.com/bluenviron/mediamtx-rpicamera updated from v2.5.7 to v2.6.0
Security
Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.
Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:
ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx
You can verify checksums of binaries by downloading checksums.sha256 and running:
Log in
