SRS Security

请将任何安全漏洞报告到这里。

GHSA-qr8h-p53p-x564​

RTC: Crash and heap overflow from a malformed RTCP packet

• Severity: High
• Advisory: GHSA-qr8h-p53p-x564
• Not vulnerable: 6.0.194+, 7.0.214+, 8.0.73+
• Vulnerable: 4.0.0-6.0.193, 7.0.0-7.0.213, 8.0.0-8.0.72
• The patch: aeb73209d (v6.0.194), d251c92a7 (v7.0.214), ab03c94b0 (v8.0.73)
• Fixed at: 2026.10.29

CVE-2024-29882​

HTTP API: DOM - XSS on JSONP callback

• Severity: High
• Advisory: GHSA-gv9r-qcjc-5hj7
• CVE-2024-29882
• Not vulnerable: 5.0.210+, 6.0.121+
• Vulnerable: 5.0.0-5.0.210, 6.0.0-6.0.121
• The patch: c75c9840d (v5.0.210), 244ce7bc0 (v6.0.121)
• Fixed at: 2024.03.28

CVE-2023-34105​

Command injection in demonstration api-server for HTTP callback.

• Severity: High
• Advisory: GHSA-vpr5-779c-cx62
• CVE-2023-34105
• Not vulnerable: v5.0.157+, v5.0-b1+, v6.0.48+
• Vulnerable: v5.0.137-v5.0.156, v6.0.18-v6.0.47
• The patch: 1e43bb6 (v5.0.157), 1d878c2 (v6.0.48)
• Fixed at: 2023.07.05