NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4 file. The issue only affects NGINX if it is built with the ngx_http_mp4_module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted mp4 file with the ngx_http_mp4_module. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Details
- CVSS 4.0 Base Score: 5.7 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 4.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nginxUpgrade nginx-mod-develUpgrade nginx-all-modulesUpgrade nginx-mod-streamUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-xslt-filterUpgrade nginx-coreUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-mailUpgrade nginx-filesystem | Apr 1, 2025 | Aug 14, 2024 |
| Alpine Linux | — | Upgrade nginx | Oct 1, 2024 | Aug 14, 2024 |
| Amazon Linux Ami 2 | — | Upgrade nginx-filesystemUpgrade nginx-mod-develUpgrade nginxUpgrade nginx-mod-http-perlUpgrade nginx-mod-mailUpgrade nginx-debuginfoUpgrade nginx-mod-streamUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-geoipUpgrade nginx-all-modulesUpgrade nginx-coreUpgrade nginx-mod-http-xslt-filter | Sep 5, 2024 | Aug 14, 2024 |
| Amazon_linux_2023 | — | Upgrade nginx-mod-streamUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-mail-debuginfoUpgrade nginx-debugsourceUpgrade nginx-debuginfoUpgrade nginx-coreUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-all-modulesUpgrade nginx-core-debuginfoUpgrade nginxUpgrade nginx-mod-mailUpgrade nginx-filesystemUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-devel | Feb 17, 2025 | Aug 14, 2024 |
| Debian | — | Upgrade nginx | Mar 26, 2025 | Aug 14, 2024 |
| Freebsd | — | Upgrade nginx-develUpgrade nginx | Aug 22, 2024 | Aug 22, 2024 |
| Gentoo Linux | — | Upgrade www-servers/nginx. | Sep 30, 2024 | Aug 14, 2024 |
| Nginx | — | Upgrade to nginx version 1.27.1Upgrade to nginx version 1.26.2 | Aug 15, 2024 | Aug 14, 2024 |
| Oracle_linux | — | Upgrade nginx-mod-develUpgrade nginx-filesystemUpgrade nginx-coreUpgrade nginxUpgrade nginx-all-modulesUpgrade nginx-mod-mailUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-streamUpgrade nginx-mod-http-image-filter | Mar 31, 2025 | Aug 14, 2024 |
| Redhat_linux | — | Upgrade nginx-filesystemUpgrade nginxUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-mod-mail-debuginfoUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-mailUpgrade nginx-mod-http-xslt-filterUpgrade nginx-all-modulesUpgrade nginx-coreUpgrade nginx-debugsourceUpgrade nginx-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-develUpgrade nginx-mod-stream-debuginfoNo solution existsUpgrade nginx-core-debuginfoUpgrade nginx-mod-stream | Mar 27, 2025 | Aug 14, 2024 |
| Rocky_linux | — | Upgrade nginx-coreUpgrade nginx-mod-http-perlUpgrade nginxUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-mod-http-image-filterUpgrade nginx-core-debuginfoUpgrade nginx-mod-mail-debuginfoUpgrade nginx-mod-develUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-streamUpgrade nginx-mod-mailUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-debugsourceUpgrade nginx-debuginfoUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-http-perl-debuginfo | Jul 31, 2025 | Jul 29, 2025 |
| Suse | — | Upgrade nginxUpgrade nginx-source | Jan 30, 2025 | Aug 14, 2024 |
| Ubuntu | — | Upgrade nginx-extrasUpgrade nginx-fullUpgrade nginx-extras (Ubuntu Pro)Upgrade nginx-core (Ubuntu Pro)Upgrade nginx-coreUpgrade nginx-full (Ubuntu Pro)Upgrade nginxUpgrade nginx (Ubuntu Pro)Upgrade nginx-common (Ubuntu Pro)Upgrade nginx-lightUpgrade nginx-commonUpgrade nginx-light (Ubuntu Pro) | Sep 17, 2024 | Aug 14, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 14, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub