{"id":"GHSA-2ccx-cjjh-r2j8","aliases":["GO-2026-4989"],"status":"published","title":"MediaMTX affected by CVE-2026-27143 due to vulnerable dependency","description":"### Summary\nRelease 1.17.1 seems affected by CVE-2026-27143. golang 1.25.9 Seems to solve the issue. Is there any new release planned?\n\n### Details\nSee https://nvd.nist.gov/vuln/detail/CVE-2026-27143.","severity":{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U","level":"low","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2026-05-06T22:39:07Z","modified":"2026-05-20T19:41:29Z","fixes":[{"ecosystem":"Go","package":"github.com/bluenviron/mediamtx","fixed_in":["1.18.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/bluenviron/mediamtx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.0"},{"fixed":"1.18.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/bluenviron/mediamtx","ranges":[{"type":"SEMVER","events":[{"introduced":"1.15.0"},{"fixed":"1.18.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/bluenviron/mediamtx","ranges":[{"type":"SEMVER","events":[{"introduced":"1.15.0"},{"fixed":"1.18.0"}]}]}],"references":[{"url":"https://github.com/bluenviron/mediamtx/security/advisories/GHSA-2ccx-cjjh-r2j8","tags":["web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27143","tags":["advisory","web"]},{"url":"https://github.com/bluenviron/mediamtx/releases/tag/v1.18.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2ccx-cjjh-r2j8"},{"url":"https://github.com/bluenviron/mediamtx","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-2ccx-cjjh-r2j8","title":"MediaMTX affected by CVE-2026-27143 due to vulnerable dependency","description":"### Summary\nRelease 1.17.1 seems affected by CVE-2026-27143. golang 1.25.9 Seems to solve the issue. Is there any new release planned?\n\n### Details\nSee https://nvd.nist.gov/vuln/detail/CVE-2026-27143.","status":"published","published":"2026-05-06T22:39:07Z","modified":"2026-05-06T22:39:07Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U","level":"low"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:40:02.883746Z"}],"osv":[{"id":"GHSA-2ccx-cjjh-r2j8","title":"MediaMTX affected by CVE-2026-27143 due to vulnerable dependency","description":"### Summary\nRelease 1.17.1 seems affected by CVE-2026-27143. golang 1.25.9 Seems to solve the issue. Is there any new release planned?\n\n### Details\nSee https://nvd.nist.gov/vuln/detail/CVE-2026-27143.","status":"published","published":"2026-05-06T22:39:07Z","modified":"2026-05-20T19:41:29.364902908Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U","level":"low"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:46:34.338541Z"},{"id":"GO-2026-4989","title":"MediaMTX affected by CVE-2026-27143 due to vulnerable dependency in github.com/bluenviron/mediamtx","description":"MediaMTX affected by CVE-2026-27143 due to vulnerable dependency in github.com/bluenviron/mediamtx","status":"published","published":"2026-05-20T19:07:16Z","modified":"2026-05-20T19:30:12.934106959Z","updated_at":"2026-11-02T15:47:02.280725Z"}]}}