DEBIAN-CVE-2026-121629
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-121629
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-121629.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-121629
- Upstream
- CVE-2026-121629
- Published
- 2026-11-09T12:16:37Z
- Modified
- 2026-11-10T05:00:06Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- [none]
- Details
-
A flaw was found in GStreamer's adaptive streaming demuxers (HLS, DASH, MSS). When processing a media playlist or manifest, URIs referenced in the manifest content are fetched without restricting which URI schemes are permitted. An attacker who controls a manifest URL, or who can inject content into an HTTP manifest response, can include file:// URIs pointing to arbitrary local files, causing the affected application to read and process those files. In automated or server-side deployments such as media recorders, proxies, and downloaders, this can lead to disclosure of sensitive local files. Existence of files can also be inferred through differing error responses even when content is not directly observable.
- References
Affected packages
Debian:12 / gst-plugins-good1.0
Package
- Name
- gst-plugins-good1.0
- Purl
- pkg:deb/debian/gst-plugins-good1.0?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
1.*
1.22.0-5
1.22.0-5+deb12u1
1.22.0-5+deb12u2
1.22.0-5+deb12u3
1.22.0-5+deb12u4
1.22.1-1
1.22.3-1
1.22.3-2
1.22.4-1
1.22.5-1
1.22.6-1
1.22.7-1
1.22.8-1
1.22.8-2
1.22.8-3
1.22.9-1
1.22.10-1
1.23.1-1
1.23.2-1
1.23.90-1
1.24.0-1
1.24.1-1
1.24.1-2
1.24.2-1
1.24.3-1
1.24.4-1
1.24.5-1
1.24.6-1
1.24.7-1
1.24.8-1
1.24.9-1
1.24.10-1
1.24.11-1
1.24.11-2
1.24.11-3
1.24.11-4
1.24.11-5
1.24.12-1
1.25.1-1
1.25.1-2
1.25.1-3
1.25.50-1
1.25.90-1
1.25.90-2
1.26.0-1
1.26.1-1
1.26.2-1
1.26.3-1
1.26.4-1
1.26.5-1
1.26.5-2
1.26.5-2+hurd.1
1.26.5-3
1.26.6-1
1.26.7-1
1.26.8-1
1.26.9-1
1.26.10-1
1.27.1-1
1.27.2-1
1.27.50-1
1.27.50-2
1.27.90-1
1.28.0-1
1.28.1-1
1.28.2-1
1.28.2-2
1.28.2-3
1.28.2-4
1.28.3-1
1.28.4-1
1.28.5-1
1.28.6-1
1.28.7-1
1.28.8-1
1.28.9-1
1.29.1-1
1.29.2-1
Debian:13 / gst-plugins-good1.0
Package
- Name
- gst-plugins-good1.0
- Purl
- pkg:deb/debian/gst-plugins-good1.0?arch=source&distro=trixie
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
1.*
1.26.2-1
1.26.2-1+deb13u1
1.26.2-1+deb13u2
1.26.3-1
1.26.4-1
1.26.5-1
1.26.5-2
1.26.5-2+hurd.1
1.26.5-3
1.26.6-1
1.26.7-1
1.26.8-1
1.26.9-1
1.26.10-1
1.27.1-1
1.27.2-1
1.27.50-1
1.27.50-2
1.27.90-1
1.28.0-1
1.28.1-1
1.28.2-1
1.28.2-2
1.28.2-3
1.28.2-4
1.28.3-1
1.28.4-1
1.28.5-1
1.28.6-1
1.28.7-1
1.28.8-1
1.28.9-1
1.29.1-1
1.29.2-1
Debian:14 / gst-plugins-good1.0
Package
- Name
- gst-plugins-good1.0
- Purl
- pkg:deb/debian/gst-plugins-good1.0?arch=source&distro=forky
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
1.*
1.26.2-1
1.26.3-1
1.26.4-1
1.26.5-1
1.26.5-2
1.26.5-2+hurd.1
1.26.5-3
1.26.6-1
1.26.7-1
1.26.8-1
1.26.9-1
1.26.10-1
1.27.1-1
1.27.2-1
1.27.50-1
1.27.50-2
1.27.90-1
1.28.0-1
1.28.1-1
1.28.2-1
1.28.2-2
1.28.2-3
1.28.2-4
1.28.3-1
1.28.4-1
1.28.5-1
1.28.6-1
1.28.7-1
1.28.8-1
1.28.9-1
1.29.1-1
1.29.2-1