MediaMTX affected by CVE-2026-27143 due to vulnerable dependency

published 2026-05-06 6mo ago modified 2026-05-20 5mo ago also GO-2026-4989

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

### Summary Release 1.17.1 seems affected by CVE-2026-27143. golang 1.25.9 Seems to solve the issue. Is there any new release planned?

### Details See https://nvd.nist.gov/vuln/detail/CVE-2026-27143.

Patch / fix

fixed in 1 links 1

go github.com/bluenviron/mediamtx 1.18.0

github.com/bluenviron/mediamtx/releases/tag/v1.18.0 release

Is GHSA-2ccx-cjjh-r2j8 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
go	github.com/bluenviron/mediamtx	>=1.15.0, <1.18.0	1.18.0

Classification

Weakness

CWE-190 Integer Overflow or Wraparound

References

github.com /bluenviron/mediamtx/security/advisories/GHSA-2ccx-cjjh-r2j8
web, advisory
nvd.nist.gov /vuln/detail/CVE-2026-27143
advisory, web
github.com /bluenviron/mediamtx
package
github.com /bluenviron/mediamtx/releases/tag/v1.18.0
web

Sources

GitHub Advisory GHSA-2ccx-cjjh-r2j8
OSV GO-2026-4989

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.