CVE-2026-102716

Name of the Vulnerable Software and Affected Versions NetX RTSP Server (affected versions not specified)

Description An unauthenticated client can cause a denial of service by draining the RTSP server's packet pool. This occurs when requests are sent containing a Session header that the parser cannot convert. Specifically, the nx utility string to uint() function fails and returns a raw NetX error code instead of a mapped RTSP status code. This raw code is then passed to the nx rtsp server error response send() function, which fails to recognize it and returns without releasing the allocated response packet. Consequently, the packet block is not returned to the pool. A small number of such malformed requests can deplete the entire pool, causing the server and potentially the rest of the application stack to stop functioning.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.