v1.5.6

Security Notice

This release includes important security updates that address two significant CVE vulnerabilities affecting previous versions of the library. Users are strongly encouraged to upgrade to this version as soon as possible to benefit from these fixes and reduce exposure to the associated security risks.

The resolved CVEs are listed below:

• CVE-2026-55869: Heap-Based Buffer Overflow in KMREQ Handling
• CVE-2026-55868: Encryption State Machine Downgrade

Security Improvements

• PR #3317: Implemented security improvements for KMREQ buffer validation. This fix addresses a vulnerability where received message sizes were not verified against the destination buffer size during the copy process. The update enforces word-aligned validation to prevent overflows when copying to internal arrays.
• PR #3319: Added strict validation of KMRSP wire length to prevent stack overflows.
• PR #3324: Resolved an OOB read in LOSSREPORT range parsing. The logic previously read a "HI" sequence number word following a "LO" marker without verifying if the "HI" word existed in the wire payload.
• PR #3320: Fixed an OOB read vulnerability in DROPREQ payload parsing. The handler now verifies that the wire payload meets the minimum 8-byte length requirement (two 32-bit sequence numbers) before attempting to process the request, preventing reads beyond the packet slot.
• PR #3322: Introduced a guard in CRcvBuffer::dropMessage to reject requested drop ranges that extend beyond the end of the receiver buffer.

Important Bug Fixes

• PR #3327: Streamlined the library cleanup sequence by removing redundant post-cleaning of closed sockets. Architecture logic dictates that the Garbage Collector (GC) thread is the primary owner of socket deletion. Once the GC thread is joined, all sockets are considered deleted; further post-checks are unnecessary and avoid potential undefined behavior in cases where the library state might be corrupted.
• PR #3310: Fixed a segmentation fault (SEGV) occurring during global or static initialization when ENABLE_HEAVY_LOGGING was active.

Build System Enhancements

• PR #3300: Transitioned the CI/CD pipeline to a robust Linux configuration matrix, serving as the modern replacement for Travis CI. The new system includes various platform and compiler combinations and incorporates specific fixes for MinGW builds and C++11 syntax compatibility.

Documentation Updates

• PR #3328: Corrected a typographical error in the documentation regarding the separator used for searchParameters.

Contributors

The following individuals contributed to the SRT v1.5.6 release:

@SergioTx @mszatmary-netflix @stevomatthews @ethouris @cl-ment

Changelog

Click to expand/collapse

Core Functionality

1e4c908 Removed unnecessary post-cleaning of closed socket in the cleanup. (#3327)
798f660 Vulnerability fixed: unchecked buffer size for KMREQ (#3317)

Build Scripts (CMake, etc.)

c39196c Added configuration for Linux with various matrix combinations (#3300)

Other

2dc8c18 [bug] searchParameters separator (#3328)
2e2ab20 [bug] Reject CRcvBuffer::dropMessage range past buffer end (#3322)
033d1d5 [bug] Fixed OOB read in LOSSREPORT range parsing (#3324)
d7957ac [bug] Fixed OOB read in DROPREQ payload parsing (#3320)
604a406 [bug] Validate KMRSP wire length to prevent stack overflow (#3319)
8e68635 [bug] Fixed a heavy-logging instruction that may crash on initialization (#3310)