huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2026-27962: authlib: Authlib: Authentication bypass due to JWK Header Injection vulnerability
Component: authlib
Severity: Important
CWE: CWE-347 (Improper Verification of Cryptographic Signature)
CVSS v3: 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Public date: 2026-03-16T17:34:38.946000+00:00

A flaw was found in Authlib, a Python library used for creating secure authentication and authorization systems. This vulnerability, known as JWK (JSON Web Key) Header Injection, affects how Authlib verifies digital signatures in JWS (JSON Web Signature) tokens. An attacker can exploit this by creating a specially crafted token that includes their own cryptographic key in the header. When the system attempts to verify this token without a predefined key, it mistakenly uses the attacker's key, allowing them to bypass authentication and gain unauthorized access.

Statement: This critical vulnerability in Authlib's JWS implementation allows unauthenticated attackers to forge JWTs by embedding their own cryptographic key in the token header. Impact is high to confidentiality and integrity as attackers can bypass authentication.

The impact for Red Hat Quay is rated as low because it imports authlib solely as a JWK parsing utility and performs all JWT signature verification through PyJWT, so the vulnerable jws.deserialize_compact() code path is never called.

Red Hat OpenShift AI is not affected, since authlib is only present as a transitive dependency in the dev dependency group and is not included in production image builds, so the vulnerable code is not present in the shipped product.

Red Hat Satellite is not affected, as authlib is only present as a dependency of fastmcp. In Satellite, fastmcp only invokes authlib using jwt.decode() which isn't able to reach the vulnerability condition even with key=none.

Affected upstream versions: < 1.6.9
Fixed upstream versions: v1.6.9
Upstream repository: https://github.com/authlib/authlib
Upstream fix commit: a5d4b2d4c9e46bfa11c82f85fdc2bcc0b50ae681
CVE-2026-27980: next.js: Next.js: Unbounded next/image disk cache growth can exhaust storage
Component: next.js
Severity: Moderate
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2026-03-18T00:23:34.862000+00:00

An unbounded disk usage flaw has been discovered in Next.js. The default Next.js image optimization disk cache (`/_next/image`) did not have a configurable upper bound, allowing unbounded cache growth. An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service.


Affected upstream versions: >= 10.0.0, < 16.1.7
Fixed upstream versions: v16.2.0
Upstream repository: https://github.com/vercel/next.js
Upstream fix commit: 39eb8e0ac498b48855a0430fbf4c22276a73b4bd
CVE-2026-28386: openssl: openssl: Denial of Service due to out-of-bounds read in AES-CFB128
Component: openssl
Severity: Moderate
CWE: CWE-805 (Buffer Access with Incorrect Length Value)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-04-07T00:00:00+00:00

A flaw was found in openssl. Applications using AES-CFB128 encryption or decryption on systems with AVX-512 and VAES support may experience a Denial of Service (DoS). This occurs when processing partial cipher blocks, specifically if the input buffer ends at a memory page boundary and the subsequent page is unmapped. This can lead to an out-of-bounds read of up to 15 bytes and a potential application crash.

Statement: This vulnerability has a Moderate impact on Red Hat products. It affects applications utilizing AES-CFB128 encryption or decryption on systems equipped with AVX-512 and VAES, potentially leading to a Denial of Service due to an out-of-bounds read when processing partial cipher blocks under specific memory conditions. The CFB mode is not employed in widely used protocols such as TLS/DTLS, which limits the applicability of this flaw.

Affected upstream versions: 3.6.0 < 3.6.2
Fixed upstream versions: 3.6.2
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: 61f428a2fc6671ede184a19f71e6e495f0689621
CVE-2026-28387: openssl: OpenSSL: Arbitrary code execution due to use-after-free in DANE TLSA authentication
Component: openssl
Severity: Low
CWE: CWE-1341 (Multiple Releases of Same Resource or Handle)
CVSS v3: 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2026-04-07T00:00:00+00:00

A flaw was found in OpenSSL. An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side. This vulnerability could lead to data corruption, application crashes, or, in severe cases, arbitrary code execution. This issue is highly specific and uncommon, as it only affects clients using both PKIX-TA(0)/PKIX-EE(1) and DANE-TA(2) certificate usages and communicating with a server publishing a TLSA record set with both types of records.

Statement: This Low impact vulnerability affects clients performing DANE TLSA-based server authentication only when configured with an uncommon combination of PKIX-TA(0/PKIX-EE(1) and DANE-TA(2) certificate usages. Most common SMTP MTA deployments are not vulnerable as they are recommended to treat PKIX certificate usages as unusable. Exploitation also requires communication with a server publishing a TLSA RRset with both types of records.

Affected upstream versions: 3.6.0 < 3.6.2, 3.5.0 < 3.5.6, 3.4.0 < 3.4.5, 3.3.0 < 3.3.7, 3.0.0 < 3.0.20, 1.1.1 < 1.1.1zg
Fixed upstream versions: 1.1.1zg, 3.0.20, 3.3.7, 3.4.5, 3.5.6, 3.6.2
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: 258a8f63b26995ba357f4326da00e19e29c6acbe
CVE-2026-28388: openssl: OpenSSL: Denial of Service due to NULL pointer dereference in delta CRL processing
Component: openssl
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-04-07T00:00:00+00:00

A flaw was found in OpenSSL. When processing a malformed delta Certificate Revocation List (CRL) that lacks a required CRL Number extension, a NULL pointer dereference can occur. This vulnerability can be exploited by a remote attacker who provides a specially crafted delta CRL to an application that has delta CRL processing enabled, leading to a Denial of Service (DoS) for the application.

Statement: Low impact. This vulnerability in X.509 certificate verification can lead to a Denial of Service (DoS) due to a NULL pointer dereference when processing a malformed delta Certificate Revocation List (CRL). Exploitation requires the `X509_V_FLAG_USE_DELTAS` flag to be enabled in the verification context, a certificate with a `freshestCRL` extension or a base CRL with `EXFLAG_FRESHEST` set, and an attacker-provided malformed CRL. This flaw is limited to DoS and does not allow for code execution or memory disclosure.

Affected upstream versions: 3.6.0 < 3.6.2, 3.5.0 < 3.5.6, 3.4.0 < 3.4.5, 3.3.0 < 3.3.7, 3.0.0 < 3.0.20, 1.1.1 < 1.1.1zg, 1.0.2 < 1.0.2zp
Fixed upstream versions: 1.0.2zp, 1.1.1zg, 3.0.20, 3.3.7, 3.4.5, 3.5.6, 3.6.2
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: 602542f2c0c2d5edb47128f93eac10b62aeeefb3
CVE-2026-28389: openssl: OpenSSL: Denial of Service vulnerability in CMS processing
Component: openssl
Severity: Low
CWE: CWE-166 (Improper Handling of Missing Special Element)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-04-07T00:00:00+00:00

A flaw was found in OpenSSL. A remote attacker could exploit this by sending a specially crafted Cryptographic Message Syntax (CMS) EnvelopedData message with KeyAgreeRecipientInfo. This vulnerability arises because the software attempts to process an optional field without verifying its existence, leading to a NULL pointer dereference. This can result in a Denial of Service (DoS) for applications that handle untrusted CMS data.

Statement: This Low impact flaw affects applications processing Cryptographic Message Syntax (CMS) data, specifically crafted CMS EnvelopedData messages with KeyAgreeRecipientInfo. A NULL pointer dereference can occur if the optional parameters field of KeyEncryptionAlgorithmIdentifier is missing, leading to a Denial of Service. Red Hat products are vulnerable if they call `CMS_decrypt()` or `PKCS7_decrypt()` on untrusted input, such as in S/MIME processing or CMS-based protocols.

Affected upstream versions: 3.6.0 < 3.6.2, 3.5.0 < 3.5.6, 3.4.0 < 3.4.5, 3.3.0 < 3.3.7, 3.0.0 < 3.0.20, 1.1.1 < 1.1.1zg, 1.0.2 < 1.0.2zp
Fixed upstream versions: 1.0.2zp, 1.1.1zg, 3.0.20, 3.3.7, 3.4.5, 3.5.6, 3.6.2
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: f80f83bc5fd036bc47d773e8b15a001e2b4ce686
CVE-2026-28390: openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing
Component: openssl
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-04-07T22:00:54.172000+00:00

A flaw was found in OpenSSL. A remote attacker could exploit this vulnerability by sending a specially crafted Cryptographic Message Syntax (CMS) EnvelopedData message. During the processing of a KeyTransportRecipientInfo with RSA-OAEP encryption, the system attempts to access an optional parameter field without first verifying its presence. This leads to a NULL pointer dereference, which can cause applications processing the attacker-controlled CMS data to crash, resulting in a Denial of Service (DoS).

Statement: This CVE has been rated as moderate by redhat because the vulnerability is limited to a denial-of-service condition caused by a NULL pointer dereference in OpenSSL CMS processing, without evidence of memory corruption or code execution, furthermore the Affected functionality is niche. The vulnerable path requires:
CMS/S/MIME processing,
specifically CMS_decrypt(),
with RSA-OAEP KeyTransportRecipientInfo.
Many OpenSSL consumers never use CMS APIs, never process S/MIME,
or do not decrypt attacker-controlled CMS objects.
So exposure is far narrower than a generic TLS parsing vulnerability.

Affected upstream versions: 3.6.0 < 3.6.2, 3.5.0 < 3.5.6, 3.4.0 < 3.4.5, 3.3.0 < 3.3.7, 3.0.0 < 3.0.20, 1.1.1 < 1.1.1zg, 1.0.2 < 1.0.2zp
Fixed upstream versions: 1.0.2zp, 1.1.1zg, 3.0.20, 3.3.7, 3.4.5, 3.5.6, 3.6.2
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: 01194a8f1941115cd0383bfa91c736dd3993c8bc
CVE-2026-28417: vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin
Component: vim
Severity: Moderate
CWE: CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
Public date: 2026-02-27T21:54:35.196000+00:00

A flaw was found in Vim, an open-source command-line text editor. Specifically, an operating system (OS) command injection vulnerability exists in the `netrw` standard plugin. A remote attacker could exploit this by tricking a user into opening a specially crafted URL, such as one using the `scp://` protocol handler. Successful exploitation allows the attacker to execute arbitrary shell commands with the same privileges as the Vim process, leading to potential system compromise.

Statement: The risk posed by this vulnerability is limited on Red Hat products due to user and system isolation features which are enabled by default. The impacts of this flaw will be limited by the active user's permissions and access control limits. Host systems are not at risk when following Red Hat guidelines and the root user account is not actively executing Vim.

Affected upstream versions: < 9.2.0073
Fixed upstream versions: v9.2.0073
Upstream repository: https://github.com/vim/vim
Upstream fix commit: 79348dbbc09332130f4c860
CVE-2026-28421: vim: Vim: Denial of service and information disclosure via crafted swap file
Component: vim
Severity: Moderate
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 5.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
Public date: 2026-02-27T22:06:34.312000+00:00

A flaw was found in Vim. This vulnerability, a heap-buffer-overflow and a segmentation fault, exists in the swap file recovery logic. A local attacker could exploit this by providing a specially crafted swap file. This could lead to a denial of service (DoS) or potentially information disclosure.

Statement: The risk posed by this vulnerability is limited on Red Hat products due to user and system isolation features which are enabled by default. The impacts of this flaw will be limited by the active user's permissions and access control limits. Host systems are not at risk when following Red Hat guidelines and the root user account is not actively executing Vim.

Affected upstream versions: < 9.2.0077
Fixed upstream versions: v9.2.0077
Upstream repository: https://github.com/vim/vim
Upstream fix commit: 65c1a143c331c886dc28
CVE-2026-28498: authlib: Authlib: Authentication bypass via forged OpenID Connect ID Tokens
Component: authlib
Severity: Important
CWE: CWE-325 (Missing Cryptographic Step)
CVSS v3: 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Public date: 2026-03-16T18:03:28.821000+00:00

A flaw was found in Authlib, a Python library used for building OAuth and OpenID Connect (OIDC) servers. This vulnerability allows a remote attacker to bypass critical integrity checks in OIDC ID Tokens. Specifically, the library's internal hash verification logic fails open when encountering an unsupported cryptographic algorithm, accepting a forged ID Token as valid. This can lead to an authentication bypass, granting unauthorized access to systems relying on Authlib for OIDC authentication.

Statement: This IMPORTANT vulnerability in Authlib allows attackers to bypass OIDC ID Token integrity verification. The at_hash and c_hash validation fails open for unknown algorithms, accepting forged tokens as valid. Exploitation requires no authentication or user interaction. Impact is high to confidentiality and integrity. Red Hat products using Authlib for OIDC validation are affected. Fixed in version 1.6.9.

Affected upstream versions: < 1.6.9
Fixed upstream versions: v1.6.9
Upstream repository: https://github.com/authlib/authlib
Upstream fix commit: b9bb2b25bf8b7e01512d847a95c1749646eaa72b
CVE-2026-28684: python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following
Component: python-dotenv
Severity: Moderate
CWE: CWE-59 (Improper Link Resolution Before File Access ('Link Following'))
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Public date: 2026-04-20T16:25:12.302000+00:00

A flaw was found in python-dotenv. A local attacker can exploit this by crafting a symbolic link, which the `set_key()` and `unset_key()` functions in python-dotenv follow when rewriting `.env` files. This can lead to the overwriting of arbitrary files on the system.


Affected upstream versions: < 1.2.2
Fixed upstream versions: v1.2.2
Upstream repository: https://github.com/theskumar/python-dotenv
Upstream fix commit: 790c5c02991100aa1bf41ee5330aca75edc51311
CVE-2026-28802: authlib: Authlib: Signature verification bypass via malicious JWT allows unauthorized access
Component: authlib
Severity: Important
CWE: CWE-347 (Improper Verification of Cryptographic Signature)
CVSS v3: 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Public date: 2026-03-06T06:44:26.402000+00:00

A flaw was found in Authlib, a Python library for building OAuth and OpenID Connect servers. A remote attacker can exploit this vulnerability by crafting a malicious JSON Web Token (JWT) with a "none" algorithm and an empty signature. This bypasses the expected signature verification, potentially allowing the attacker to forge tokens and gain unauthorized access or perform unauthorized actions within applications using Authlib.


Affected upstream versions: >= 1.6.5, < 1.6.7
Fixed upstream versions: v1.6.0
Upstream repository: https://github.com/authlib/authlib
Upstream fix commit: a61c2acb807496e67f32051b5f1b1d5ccf8f0a75
CVE-2026-29004: BusyBox: BusyBox: Arbitrary Code Execution via DHCPv6 Client Heap Buffer Overflow
Component: BusyBox
Severity: Important
CWE: CWE-131 (Incorrect Calculation of Buffer Size)
CVSS v3: 8.8 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-04T18:05:18.962000+00:00

A flaw was found in BusyBox. A heap buffer overflow vulnerability exists in the Dynamic Host Configuration Protocol version 6 (DHCPv6) client, specifically within the `option_to_env()` function. Network-adjacent attackers can exploit this by sending a crafted DHCPv6 response containing a malformed D6_OPT_DNS_SERVERS option. This can lead to memory corruption, potentially allowing for arbitrary code execution or denial of service on affected embedded systems lacking heap hardening.


Affected upstream versions: <= 1_37_0
Upstream repository: https://github.com/vda-linux/busybox_mirror
Upstream fix commit: 42202bfb1e6ac51fa995beda8be4d7b654aeee2a
CVE-2026-29111: systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data
Component: systemd
Severity: Moderate
CWE: CWE-1287 (Improper Validation of Specified Type of Input)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-03-23T21:03:56.120000+00:00

A flaw was found in systemd, a system and service manager. An unprivileged user can exploit this vulnerability by making an Inter-Process Communication (IPC) API call with spurious data. In older versions (v249 and earlier), this can lead to stack overwriting with attacker-controlled content, potentially enabling arbitrary code execution or privilege escalation. In newer versions (v250 and later), the flaw causes systemd to assert and freeze, resulting in a Denial of Service (DoS).


Affected upstream versions: >= 239, < 257.11, >= 258, < 258.5, >= 259, < 259.2
Fixed upstream versions: v258.5
Upstream repository: https://github.com/systemd/systemd
Upstream fix commit: 1d22f706bd04f45f8422e17fbde3f56ece17758a
CVE-2026-2920: gstreamer-plugins-ugly: GStreamer: Arbitrary code execution via ASF file processing
Component: gstreamer-plugins-ugly
Severity: Important
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2026-03-13T20:38:27.802000+00:00

A flaw was found in GStreamer. This heap-based buffer overflow vulnerability in the ASF Demuxer component allows a remote attacker to execute arbitrary code. The issue arises from insufficient validation of user-supplied data length when processing stream headers within ASF (Advanced Systems Format) files, leading to data being copied to a fixed-length heap-based buffer without proper bounds checking. Successful exploitation can result in arbitrary code execution in the context of the current process.

Statement: This is an IMPORTANT heap-based buffer overflow vulnerability in the GStreamer ASF Demuxer. The flaw allows remote code execution when processing specially crafted ASF files due to improper validation of stream header lengths. Red Hat products utilizing GStreamer for multimedia processing are affected if they handle untrusted ASF content.

Affected upstream versions: 1c6e163aa33962f5ee4a87d29319ccdd5cb67612
Fixed upstream versions: 1.29.1
Upstream repository: https://gitlab.freedesktop.org/gstreamer/gstreamer
Upstream fix commit: 37d7991168a223d0810fd1f4493ec6a8b6a510d3
CVE-2026-2921: gstreamer-plugins-base: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling
Component: gstreamer-plugins-base
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2026-03-13T20:41:50.780000+00:00

A flaw was found in GStreamer. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. The flaw exists within the handling of palette data in AVI files, where a lack of proper validation of user-supplied data can lead to an integer overflow before writing to memory. An attacker can leverage this integer overflow to execute code in the context of the current process.

Statement: This is an IMPORTANT vulnerability in GStreamer that allows arbitrary code execution. The flaw occurs due to an integer overflow when processing palette data in specially crafted AVI files. Exploitation requires a user to process a malicious AVI file with an application linked against the GStreamer library.

Affected upstream versions: 1c6e163aa33962f5ee4a87d29319ccdd5cb67612
Fixed upstream versions: 1.29.1
Upstream repository: https://gitlab.freedesktop.org/gstreamer/gstreamer
Upstream fix commit: e3a99c35266fc92dd6a18ac5fde028d0cda559e6
CVE-2026-2922: gstreamer-plugins-ugly: GStreamer: Remote Code Execution via out-of-bounds write in RealMedia Demuxer
Component: gstreamer-plugins-ugly
Severity: Important
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2026-03-13T20:38:49.124000+00:00

A flaw was found in GStreamer. This vulnerability allows a remote attacker to execute arbitrary code by exploiting an out-of-bounds write in the RealMedia Demuxer component. The issue occurs due to improper validation of user-supplied data during the processing of video packets, leading to a write past the end of an allocated buffer. Successful exploitation can result in arbitrary code execution within the context of the current process.

Statement: This IMPORTANT vulnerability in the GStreamer RealMedia Demuxer allows remote attackers to execute arbitrary code. The flaw occurs due to improper validation of user-supplied data when processing video packets, leading to an out-of-bounds write. Exploitation requires user interaction with a specially crafted RealMedia file.

Affected upstream versions: 1c6e163aa33962f5ee4a87d29319ccdd5cb67612
Fixed upstream versions: 1.29.1
Upstream repository: https://gitlab.freedesktop.org/gstreamer/gstreamer
Upstream fix commit: 88df8d2cd063b95a076e8041b47f778a4402f363
CVE-2026-2923: gstreamer-plugins-bad: GStreamer: Remote Code Execution via out-of-bounds write in DVB Subtitles handling
Component: gstreamer-plugins-bad
Severity: Important
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2026-03-13T20:39:01.199000+00:00

A flaw was found in GStreamer. This out-of-bounds write vulnerability in the DVB (Digital Video Broadcasting) Subtitles handling allows remote attackers to execute arbitrary code. The issue stems from improper validation of user-supplied coordinate data, which can lead to writing beyond the boundaries of an allocated memory buffer. Successful exploitation can result in arbitrary code execution within the context of the current process.

Statement: IMPORTANT: A vulnerability in GStreamer's DVB subtitles component allows remote code execution due to an out-of-bounds write caused by improper validation of user-supplied data. This affects Red Hat Enterprise Linux versions that include GStreamer. Exploitation requires interaction with the GStreamer library, typically through processing malicious DVB subtitle streams.

Affected upstream versions: 1c6e163aa33962f5ee4a87d29319ccdd5cb67612
Fixed upstream versions: 1.29.1
Upstream repository: https://gitlab.freedesktop.org/gstreamer/gstreamer
Upstream fix commit: 3b8253f447bcc9831dbf643d2c69b205fedbe086