PT-2026-56199 · Red Hat · Red Hat Enterprise Linux 10+4

Published 2026-07-07 · Updated 2026-07-07 · CVE-2026-14935

NVD

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

A logic vulnerability was found in GStreamer's webrtcbin component. The check sdp crypto() function contains an inverted boolean condition that causes it to accept remote SDP offers or answers that lack the required a=fingerprint attribute, while incorrectly rejecting those that include it. An attacker with the ability to intercept and modify WebRTC signaling messages could exploit this to bypass the SDP-level DTLS certificate fingerprint binding, weakening defenses against man-in-the-middle attacks on media streams.

Fix

Weakness Enumeration

CWE-670

Related Identifiers

CVE-2026-14935

Affected Products

Red Hat Enterprise Linux 10

Red Hat Enterprise Linux 6

Red Hat Enterprise Linux 7

Red Hat Enterprise Linux 8

Red Hat Enterprise Linux 9

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-14935 · Security Note
• https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5171 · Note
• https://access.redhat.com/security/cve/CVE-2026-14935 · Note
• https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/merge_requests/98 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2497679 · Note