CVE-2021-38380: Live555 through 1.08 mishandles huge requests for the same MP3 stream, leading to recursion and s stack-bas...

Security readout for executives and security teams

This issue can let an unauthenticated client crash a Live555-based streaming service by sending very large requests for the same MP3 stream. The documented impact is denial of service, not data theft or code execution. Exposure is most likely where Live555 is used to serve MP3 streams to untrusted clients, especially internet-facing streaming or RTSP services. The CVE bundle does not name downstream products. Treat this as a targeted availability risk for streaming services. Prioritize internet-facing Live555 deployments, especially where service uptime matters, but do not escalate as a confirmed exploited or code-execution issue based on current sources. Mitigation focus: Inventory deployments using Live555 and identify versions at or below 1.08.; Review the Live555 2021-08-04 changelog and vendor guidance for the relevant fix path.; Update affected Live555 deployments when the vendor-supported fixed version is confirmed..

Prepared

Jun 2, 2026, 19:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.