Summary
It was discovered that SRT did not authenticate certain encryption control
messages. A remote attacker could possibly use this issue to downgrade an
encrypted connection and inject arbitrary content or interrupt a media
stream. (CVE-2026-55868)
It was discovered that SRT did not properly validate certain control
packets during connection setup and key refresh operations. A remote
attacker could possibly use this issue to cause SRT to crash, resulting in
a denial of service. (CVE-2026-55869)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | srt | 1.4.0-1ubuntu0.1~esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | srt | 1.4.4-4ubuntu0.1~esm1 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | srt | 1.5.3-1ubuntu0.1~esm1 |
| Ubuntu · Pro 26.04 LTS Pro:26.04:LTS | srt | 1.5.4-3ubuntu0.1~esm1 |