CVE-2026-108830

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-108830
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108830.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-108830
Downstream
Published
2026-10-12T11:45:13Z
Modified
2026-10-15T07:08:15Z
Severity
  • 1.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
meetecho janus-gateway VideoRoom janus_videoroom.c race condition
Details

A weakness has been identified in meetecho janus-gateway up to 1.4.2. This affects an unknown part of the file src/plugins/janus_videoroom.c of the component VideoRoom. This manipulation causes race condition. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been made available to the public and could be used for attacks. Patch name: 27c0d1af888153e818675b56a4e6267f62d57097. Applying a patch is the recommended action to fix this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Database specific 
{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-362"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108830.json"
}
References

Affected packages

Git / github.com/meetecho/janus-gateway

Affected ranges

Type
GIT
Repo
https://github.com/meetecho/janus-gateway
Events
Introduced
aa86122d740f10f7731c4fa411a2473f58486e4e
Fixed
27c0d1af888153e818675b56a4e6267f62d57097
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "1.4.0"
        },
        {
            "last_affected":  "1.4.0"
        },
        {
            "introduced":  "1.4.1"
        },
        {
            "last_affected":  "1.4.1"
        },
        {
            "introduced":  "1.4.2"
        },
        {
            "last_affected":  "1.4.2"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.4.0
1.4.1
1.4.2
v1.*
v1.4.0
v1.4.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108830.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "166123540112391182978256449992354453725",
            "length":  5855
        },
        "id":  "CVE-2026-108830-1cff4cd9",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/meetecho/janus-gateway/commit/27c0d1af888153e818675b56a4e6267f62d57097",
        "target":  {
            "file":  "src/plugins/janus_videoroom.c",
            "function":  "janus_videoroom_hangup_media_internal"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "115691904800405132755826336699958455239",
            "length":  121030
        },
        "id":  "CVE-2026-108830-321b6095",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/meetecho/janus-gateway/commit/27c0d1af888153e818675b56a4e6267f62d57097",
        "target":  {
            "file":  "src/plugins/janus_videoroom.c",
            "function":  "janus_videoroom_process_synchronous_request"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "143548949841886666255289140345939387471",
            "length":  116326
        },
        "id":  "CVE-2026-108830-57265520",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/meetecho/janus-gateway/commit/27c0d1af888153e818675b56a4e6267f62d57097",
        "target":  {
            "file":  "src/plugins/janus_videoroom.c",
            "function":  "janus_videoroom_handler"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "326950233546636244037267310694482216820",
            "length":  2311
        },
        "id":  "CVE-2026-108830-92faf31e",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/meetecho/janus-gateway/commit/27c0d1af888153e818675b56a4e6267f62d57097",
        "target":  {
            "file":  "src/plugins/janus_videoroom.c",
            "function":  "janus_videoroom_setup_media"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "249029783348041077307619637793493285961",
                "24868647835557794809157006375444864053",
                "317539639305141441960027309148027906937",
                "144062334836770012451366387228767329354",
                "282837392213399563165049572076856643266",
                "145082218472888609241519894349216649944",
                "212279486097815951082098295334297249955",
                "237426662563817886500504196058848171622",
                "321170765079540285216232193458271286522",
                "43102917290044345848163932532694885357",
                "283347857991496406998538142146015621396",
                "37912911220246138862968871592398721636",
                "216522256053456051474518882598226134398",
                "254790364182011229028546235966130018927",
                "219392911407977114146667106275618641407",
                "75096827487324894444234166027997837924",
                "234058367533431408710229845147417716001",
                "153274633176808611466084589743580559818",
                "65521828156876989651878022708021597983",
                "51228836217016757384883745897387444530",
                "97535732706375425881315041859742627439",
                "106416675535872468246400044501087298231",
                "204642870685164540641752549906132909846",
                "34875288026828106063936667600037904571",
                "152078385992601386884321041215965100579",
                "211931597225676418726198890985633897385",
                "195972170990050150631294896119327738545",
                "48283875392865726471671489589071872387",
                "231190587456988743504821049806045162966",
                "179046467225203323748061750118972670691",
                "81289379707605085749615373783133323022",
                "227990811639802613078132875165299260294",
                "186591563881657820362636740229476091578",
                "43521431552667049432429611421944757826",
                "74181251367630959810479816224472895730",
                "95786361737397476965218133126400340121",
                "76303290123832498820648701856349150147",
                "102294707572004216179806645477897150417",
                "103736079922344787871549256964043866352",
                "272549193959887811989367364188041796393",
                "17216047563057733092864019591907813430",
                "330414243511309051219495036165504634162",
                "45520250802603593180575817808023277419"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-108830-e7ae9138",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/meetecho/janus-gateway/commit/27c0d1af888153e818675b56a4e6267f62d57097",
        "target":  {
            "file":  "src/plugins/janus_videoroom.c"
        }
    }
]
vanir_signatures_modified 
"2026-10-15T07:08:15Z"