{"id":"CVE-2026-55869","aliases":["DEBIAN-CVE-2026-55869","MGASA-2026-0469","UBUNTU-CVE-2026-55869","USN-8764-1","openSUSE-SU-2026:11357-1"],"status":"published","title":"Updated srt package fixes security vulnerabilities","description":"Encryption State Machine Downgrade. (CVE-2026-55868)\nKMREQ/KMRSP Stack-Based Buffer Overflow. (CVE-2026-55869)","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-07-21T06:48:18.854341403Z","modified":"2026-10-06T16:30:03Z","fixes":[{"ecosystem":"Debian:13","package":"srt","fixed_in":["1.5.4-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"srt","fixed_in":["1.5.6-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"srt","fixed_in":["1.4.0-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"srt","fixed_in":["1.4.4-4ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"srt","fixed_in":["1.5.3-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:26.04:LTS","package":"srt","fixed_in":["1.5.4-3ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"srt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.1-1","1.5.1-1+deb12u1","1.5.2-1","1.5.3-1","1.5.3-2","1.5.4-1","1.5.4-2","1.5.4-3","1.5.5-1","1.5.6-1"]},{"source":"osv","ecosystem":"Debian:13","package":"srt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.4-1+deb13u1"}]}],"versions":["1.5.4-1"]},{"source":"osv","ecosystem":"Debian:14","package":"srt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.6-1"}]}],"versions":["1.5.4-1","1.5.4-2","1.5.4-3","1.5.5-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"srt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.4-2.1.mga10"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"srt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-1ubuntu0.1~esm1"}]}],"versions":["1.3.2-1","1.4.0-1","1.4.0-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"srt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-4ubuntu0.1~esm1"}]}],"versions":["1.4.2-1.4","1.4.2-1.4ubuntu1","1.4.4-4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"srt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-1ubuntu0.1~esm1"}]}],"versions":["1.5.2-1","1.5.3-1","1.5.3-1build1","1.5.3-1build2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"srt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.4-3ubuntu0.1~esm1"}]}],"versions":["1.5.4-1","1.5.4-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"srt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-1ubuntu0.1~esm1"}]}],"versions":["1.3.2-1","1.4.0-1","1.4.0-1build1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"srt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-4ubuntu0.1~esm1"}]}],"versions":["1.4.2-1.4","1.4.2-1.4ubuntu1","1.4.4-4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"srt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-1ubuntu0.1~esm1"}]}],"versions":["1.5.2-1","1.5.3-1","1.5.3-1build1","1.5.3-1build2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"srt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.4-3ubuntu0.1~esm1"}]}],"versions":["1.5.4-1","1.5.4-3"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"srt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.6-1.1"}]}],"bundled":2}],"references":[{"url":"https://security-tracker.debian.org/tracker/CVE-2026-55869","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0469.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36158","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/XN3R27AYMZKANUF4IXBPFLBC773HW7LM/","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00361.html","tags":["web"]},{"url":"https://github.com/Haivision/srt/security/advisories/GHSA-4mc6-qmpp-g7gw","tags":["advisory"]},{"url":"https://github.com/Haivision/srt/security/advisories/GHSA-6xg9-784j-24rm","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2026-55869","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55869","tags":["report"]},{"url":"https://github.com/Haivision/srt/pull/3345","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8764-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-55868","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55869","tags":["web"]}],"sources":{"osv":[{"id":"DEBIAN-CVE-2026-55869","status":"published","published":"2026-07-21T06:48:18.854341403Z","modified":"2026-09-01T15:06:10.174495366Z","updated_at":"2026-11-02T15:45:57.590991Z"},{"id":"MGASA-2026-0469","title":"Updated srt package fixes security vulnerabilities","description":"Encryption State Machine Downgrade. (CVE-2026-55868)\nKMREQ/KMRSP Stack-Based Buffer Overflow. (CVE-2026-55869)\n","status":"published","published":"2026-10-06T16:25:00Z","modified":"2026-10-06T16:30:03.43990655Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11357-1","title":"libsrt1_5-1.5.6-1.1 on GA media","description":"These are all security issues fixed in the libsrt1_5-1.5.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-23T00:00:00Z","modified":"2026-07-24T17:16:09.549032785Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"UBUNTU-CVE-2026-55869","description":"[Heap-Based Buffer Overflow in KMREQ Handling]","status":"published","published":"2026-07-22T00:00:00Z","modified":"2026-09-15T20:16:39.281790768Z","updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"USN-8764-1","title":"srt vulnerabilities","description":"It was discovered that SRT did not authenticate certain encryption control\nmessages. A remote attacker could possibly use this issue to downgrade an\nencrypted connection and inject arbitrary content or interrupt a media\nstream. (CVE-2026-55868)\n\nIt was discovered that SRT did not properly validate certain control\npackets during connection setup and key refresh operations. A remote\nattacker could possibly use this issue to cause SRT to crash, resulting in\na denial of service. (CVE-2026-55869)","status":"published","published":"2026-09-15T13:49:39Z","modified":"2026-09-16T02:57:26.247975917Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}