CVE-2026-107677

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>ffmpeg</name>
	<range><lt>FIXME</lt></range>
      </package>
      <package>
	<name>ffmpeg-nox11</name>
	<range><lt>FIXME</lt></range>
      </package>
      <package>
	<name>ffmpeg3</name>
	<range><lt>FIXME</lt></range>
      </package>
      <package>
	<name>ffmpeg4</name>
	<range><lt>FIXME</lt></range>
      </package>
      <package>
	<name>linux-rl9-ffmpeg-libs</name>
	<range><lt>FIXME</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>FFmpeg through 9.0.2 contains a denial of service vulnerability in the
	DASH demuxer that allows attackers to trigger an infinite loop by
	supplying an empty SegmentTemplate media URL. Attackers can craft an
	.mpd manifest declaring SegmentTemplate media="" so
	get_current_fragment() calls av_strireplace() with an empty search
	string, consuming CPU indefinitely.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-107677</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-107677</url>
    </references>
    <dates>
      <discovery>2026-10-08</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>