CVE-2026-102716

/// Technical description

An unauthenticated client can drain the RTSP server's packet pool with a couple of dozen requests

that carry a Session header the parser cannot convert.

The Session branch returns the raw NetX error code instead of an RTSP status code:

```c

/* addons/rtsp/nx_rtsp_server.c:2754 */

status = _nx_utility_string_to_uint(field_value_ptr, field_value_length, &session_id);

if (status)

{

return(status); /* NX_INVALID_PARAMETERS / NX_SIZE_ERROR / NX_OVERFLOW */

}

```

Every other branch of the same function maps its failure to an RTSP status first. The CSeq branch

eighteen lines earlier does exactly that (line 2736 returns NX_RTSP_STATUS_CODE_BAD_REQUEST). The

raw code then reaches `_nx_rtsp_server_error_response_send` (nx_rtsp_server.c:1234), which does not

recognise it, takes a path that returns without releasing the response packet it already allocated,

and the block never goes back to the pool.

Six requests with an empty Session header aga

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References