« List of all CVEs

CVE-2023-6605

Ffmpeg: dash playlist ssrf vulnerability in ffmpeg

Published: 1/6/2025 Last updated: 11/3/2025 Reserved: 12/8/2023

A flaw was found in FFmpeg's DASH playlist support. This vulnerability allows arbitrary HTTP GET requests to be made on behalf of the machine running FFmpeg via a crafted DASH playlist containing malicious URLs.

CNA assigner: fedora (92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5) Requested by: n/a

Metrics

Version Score Severity Vector String
3.1 7.2 High CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Opam packages affected (3)

conf-ffmpeg ffmpeg opus

Products affected (2)

Product Vendor Version
n/a
>= 3.1.0, < 6.1.7.9

References (4)