CVE-2023-6605 Ffmpeg: dash playlist ssrf vulnerability in ffmpeg
FFmpeg allows Server-Side Request Forgery via crafted DASH playlists, enabling attackers to make arbitrary HTTP requests from the host system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-6605?
CVE-2023-6605 is a high-severity server-side request forgery vulnerability in Ffmpeg Ffmpeg, published on 6 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in FFmpeg's DASH playlist support. This vulnerability allows arbitrary HTTP GET requests to be made on behalf of the machine running FFmpeg via a crafted DASH playlist containing malicious URLs.
Weakness: CWE-99
Which versions are affected by CVE-2023-6605?
It affects 1 product.
Products include Ffmpeg Ffmpeg.
How do I fix CVE-2023-6605?
Apply the vendor's patch.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2023-6605 being exploited?
There is no known exploitation of CVE-2023-6605 in the wild and no public exploit code.
Other vulnerabilities in Ffmpeg Ffmpeg
Sources
Also known as DEBIAN-CVE-2023-6605, GHSA-6r4h-f9rf-frm2, JLSEC-2025-147, UBUNTU-CVE-2023-6605.