CVE-2022-41741highCWE-787

CVE-2022-41741: falha de alta gravidade em F5 NGINX

NGINX ngx_http_mp4_module vulnerability CVE-2022-41741

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar NGINX Plus+ Monitorar NGINX

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7epss 0.8%
NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to corrupt NGINX worker memory, resulting in its termination or potential other impact using a specially crafted audio or video file. The issue affects only NGINX products that are built with the ngx_http_mp4_module, when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_mp4_module.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
F5 · NGINXF5 · NGINX Open Source SubscriptionF5 · NGINX Plus
CVEs relacionadas — F5 NGINX

No mesmo produto, das mais perigosas para as menos.

CVE-2026-42945CRITICALNGINX ngx_http_rewrite_module vulnerabilityEPSS 68.0%CVE-2026-27654HIGHNGINX ngx_http_dav_module vulnerabilityEPSS 26.5%CVE-2026-9256CRITICALNGINX ngx_http_rewrite_module vulnerabilityEPSS 10.9%CVE-2026-42055CRITICALNGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerabilityEPSS 6.5%CVE-2026-42533CRITICALNGINX Map directive and Regex matching vulnerabilityEPSS 6.3%CVE-2025-23419MEDIUMTLS Session Resumption VulnerabilityEPSS 2.7%