Read the docs
TI-2022-20128 Aliases CVE-2022-41741GHSA-3v5h-538g-pr7g

NGINX ngx_http_mp4_module vulnerability CVE-2022-41741

Priority LOW 38CWE-787Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 6 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-787 and the CVSS impact.

Summary

NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to corrupt NGINX worker memory, resulting in its termination or potential other impact using a specially crafted audio or video file. The issue affects only NGINX products that are built with the ngx_http_mp4_module, when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_mp4_module.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00811 57th percentileScored 2026-11-07
Fix Partial NGINX (F5): 1.23.2, 1.22.1NGINX Plus (F5): R27-p1, R26-p1+1 more productRed Hat: 3 advisoriesRed Hat: 6 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
F5NGINXMainline to before 1.23.2; Stable to before 1.22.11.23.2, 1.22.1Patch availableCNA
F5NGINX PlusR27 to before R27-p1; R1 to before R26-p1R27-p1, R26-p1Patch availableCNA
F5NGINX Open Source SubscriptionR2 to before R2 P1; R1 to before R1 P1R2 P1, R1 P1Patch availableCNA
  • NGINX VendorF5 Affected Mainline to before 1.23.2; Stable to before 1.22.1 Fixed in 1.23.2, 1.22.1 Patch available CNA
  • NGINX Plus VendorF5 Affected R27 to before R27-p1; R1 to before R26-p1 Fixed in R27-p1, R26-p1 Patch available CNA
  • NGINX Open Source Subscription VendorF5 Affected R2 to before R2 P1; R1 to before R1 P1 Fixed in R2 P1, R1 P1 Patch available CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:f5:nginx:*:*:*:*:open_source:*:*:*1.1.3 – 1.22.0VulnerableF5
cpe:2.3:a:f5:nginx:*:*:*:*:plus:*:*:*r22 – r27VulnerableF5
cpe:2.3:a:f5:nginx:1.23.0:*:*:*:open_source:*:*:*1.23.0VulnerableF5
cpe:2.3:a:f5:nginx:1.23.1:*:*:*:open_source:*:*:*1.23.1VulnerableF5
cpe:2.3:a:f5:nginx:r1:*:*:*:open_source_subscription:*:*:*r1VulnerableF5
cpe:2.3:a:f5:nginx:r2:*:*:*:open_source_subscription:*:*:*r2VulnerableF5
cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*1.9.0 – 1.12.4; 2.0.0 – 2.4.0VulnerableF5
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*35VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*36VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*37VulnerableFedoraproject
  • cpe:2.3:a:f5:nginx:*:*:*:*:open_source:*:*:* Versions 1.1.3 – 1.22.0 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:*:*:*:*:plus:*:*:* Versions r22 – r27 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.23.0:*:*:*:open_source:*:*:* Versions 1.23.0 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.23.1:*:*:*:open_source:*:*:* Versions 1.23.1 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:r1:*:*:*:open_source_subscription:*:*:* Versions r1 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:r2:*:*:*:open_source_subscription:*:*:* Versions r2 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:* Versions 1.9.0 – 1.12.4; 2.0.0 – 2.4.0 Vulnerable ·F5
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian

Remediation

  • Fix · CNA NGINX (F5) Fixed in 1.23.2, 1.22.1
  • Fix · CNA NGINX Plus (F5) Fixed in R27-p1, R26-p1
  • Fix · CNA NGINX Open Source Subscription (F5) Fixed in R2 P1, R1 P1

Red Hat 3 advisories

  • RHSA-2025:7619 Released 2025-05-14 · Red Hat rating Moderate
    nginx security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) nginx-mod-devel-1:1.20.1-16.el9_4.3
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) nginx-1:1.20.1-16.el9_4.3, nginx-all-modules-1:1.20.1-16.el9_4.3, nginx-core-1:1.20.1-16.el9_4.3 +6
  • RHSA-2025:7546 Released 2025-05-14 · Red Hat rating Moderate
    nginx security update
    • Red Hat CodeReady Linux Builder EUS (v.9.2) nginx-mod-devel-1:1.20.1-14.el9_2.3
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) nginx-1:1.20.1-14.el9_2.3, nginx-all-modules-1:1.20.1-14.el9_2.3, nginx-core-1:1.20.1-14.el9_2.3 +6
  • RHSA-2025:7402 Released 2025-05-13 · Red Hat rating Moderate
    nginx security update
    • Red Hat Enterprise Linux AppStream (v. 9) nginx-2:1.20.1-22.el9_6.2, nginx-all-modules-2:1.20.1-22.el9_6.2, nginx-core-2:1.20.1-22.el9_6.2 +6
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) nginx-mod-devel-2:1.20.1-22.el9_6.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    F5 NGINX, NGINX Open Source Subscription, NGINX Plus — FEDORA-2022-b0f5bc2175

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2022-20129 NGINX ngx_http_mp4_module vulnerability CVE-2022-41742Priority LOW 36
    Show all 2 records → Advisory →
  • Advisory ·

    F5 NGINX, NGINX Open Source Subscription, NGINX Plus — FEDORA-2022-97de53f202

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2022-20129 NGINX ngx_http_mp4_module vulnerability CVE-2022-41742Priority LOW 36
    Show all 2 records → Advisory →
Show 2 more groups
  • Advisory ·

    F5 NGINX, NGINX Open Source Subscription, NGINX Plus — FEDORA-2022-12721789aa

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2022-20129 NGINX ngx_http_mp4_module vulnerability CVE-2022-41742Priority LOW 36
    Show all 2 records → Advisory →
  • Advisory ·

    F5 NGINX, NGINX Open Source Subscription, NGINX Plus — DSA-5281

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2022-20129 NGINX ngx_http_mp4_module vulnerability CVE-2022-41742Priority LOW 36
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ansible Automation Platform 1.2AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Software CollectionsAffectedNo fix planned: Will not fix
Red Hat CodeReady Linux Builder EUS (v.9.2)Fixed RHSA-2025:7546
Red Hat CodeReady Linux Builder EUS (v.9.4)Fixed RHSA-2025:7619
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:7402
Red Hat Enterprise Linux AppStream EUS (v.9.2)Fixed RHSA-2025:7546
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2025:7619
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2025:7402
Not affected: 1 product
  • Red Hat Ansible Automation Platform 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-41741
  2. 2026-10-03 Alias added: GHSA-3v5h-538g-pr7g

References

Advisory 7

  • TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2013-01799 The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0… CVSS 2.0HIGH 7.5
  • TI-2016-00666 The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to… CVSS 3.1HIGH 7.5
  • TI-2019-06948 Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a… CVSS 3.1HIGH 7.5
  • TI-2009-02513 Buffer underflow in src/http/ngx_http_parse.c in nginx 0.1.0 through 0.5.37, 0.6.x before… CVSS 2.0HIGH 7.5
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences