What’s Vulnerable › Vulnerabilities

CVE-2024-7347: NGINX MP4 module vulnerability

• Severity: medium (CVSS 4.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-08-14 · updated 2026-06-17
• Weakness: CWE-126

Description

NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4 file. The issue only affects NGINX if it is built with the ngx_http_mp4_module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted mp4 file with the ngx_http_mp4_module.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected products

• F5 NGINX Open Source: from 1.5.13 before 1.26.2; 1.27.0 — fixed in 1.26.2
• F5 NGINX Plus: from r27 before r31; r31, r31-p1, r32 — fixed in r31

How to fix

Upgrade to a fixed version: F5 NGINX Open Source 1.26.2; F5 NGINX Plus r31. Check the vendor advisory for mitigations.

References

• https://my.f5.com/manage/s/article/K000140529
• http://www.openwall.com/lists/oss-security/2024/08/14/4
• https://lists.debian.org/debian-lts-announce/2025/03/msg00017.html

Get alerted when CVE-2024-7347 or the next vulnerability affects your stack