Description
nginx before versions 1.15.6, 1.14.1 has a vulnerability in the ngx_http_mp4_module, which might allow an attacker to cause infinite loop in a worker process, cause a worker process crash, or might result in worker process memory disclosure by using a specially crafted mp4 file. The issue only affects nginx if it is built with the ngx_http_mp4_module (the module is not built by default) and the .mp4. directive is used in the configuration file. Further, the attack is only possible if an attacker is able to trigger processing of a specially crafted mp4 file with the ngx_http_mp4_module.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| [UNKNOWN] | nginx | 1.15.6, 1.14.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nginx | 1.14.1-1 | — |
| Debian 13 | nginx | 1.14.1-1 | — |
| Debian 12 | nginx | 1.14.1-1 | — |
| Debian 9 | nginx | 1.10.3-1+deb9u2 | DSA-4335-1 |
| Debian 8 | nginx | 1.6.2-5+deb8u6 | DLA-1572-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | nginx | 1.14.0-0ubuntu1.2 | USN-3812-1 |
| Ubuntu 16.04 LTS | nginx | 1.10.3-0ubuntu0.16.04.3 | USN-3812-1 |
| Ubuntu 14.04 LTS | nginx | 1.4.6-1ubuntu3.9 | USN-3812-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | rh-nginx110-nginx +5 | 1:1.10.2-8.el6.1 | RHSA-2018:3653 |
| RHEL 3 | rh-nginx112-nginx +5 | 1:1.12.1-2.el7.1 | RHSA-2018:3680 |
| RHEL 3 | rh-nginx114-nginx +5 | 1:1.14.1-1.el7 | RHSA-2018:3681 |
| RHEL 3 | rh-nginx18-nginx | 1:1.8.1-1.el6.1 | RHSA-2018:3652 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | nginx | 1.14.2-6.3.1 | SUSE-SU-2019:2309-1 |
| SLES 15 | nginx | 1.14.2-3.3.1 | SUSE-SU-2019:0334-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 12 | nginx | 1.14.2-16.1 | openSUSE-SU-2019:0195-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | nginx | 1.21.3-1.4 | openSUSE-SU-2024:11092-1 |
| openSUSE Leap 15.1 | nginx | 1.14.2-lp151.4.3.1 | openSUSE-SU-2019:2120-1 |
| openSUSE Leap 15.0 | nginx | 1.14.2-16.1 | openSUSE-SU-2019:0195-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | nginx | 1.14.1-r0 | — |
| Alpine v3.23 | nginx | 1.14.1-r0 | — |
| Alpine v3.22 | nginx | 1.14.1-r0 | — |
| Alpine v3.21 | nginx | 1.14.1-r0 | — |
| Alpine v3.20 | nginx | 1.14.1-r0 | — |
Show 14 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | nginx | 1.14.1-r0 | — |
| Alpine v3.18 | nginx | 1.14.1-r0 | — |
| Alpine v3.17 | nginx | 1.14.1-r0 | — |
| Alpine v3.16 | nginx | 1.14.1-r0 | — |
| Alpine v3.15 | nginx | 1.14.1-r0 | — |
| Alpine v3.14 | nginx | 1.14.1-r0 | — |
| Alpine v3.13 | nginx | 1.14.1-r0 | — |
| Alpine v3.12 | nginx | 1.14.1-r0 | — |
| Alpine v3.11 | nginx | 1.14.1-r0 | — |
| Alpine v3.10 | nginx | 1.14.1-r0 | — |
| Alpine v3.9 | nginx | 1.14.1-r0 | — |
| Alpine v3.8 | nginx | 1.14.1-r0 | — |
| Alpine v3.7 | nginx | 1.12.1-r4 | — |
| Alpine v3.6 | nginx | 1.12.2-r2 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | nginx +7 | 1:1.17.7-2.el7 | ELSA-2020-5862, ELSA-2020-5859 |
| Oracle Linux 7 | olcne-istio-chart +1 | 1.1.6-1.el7 | ELSA-2020-5859 |
| Oracle Linux 7 | olcnectl +4 | 1.0.8-2.el7 | ELSA-2020-5862, ELSA-2020-5859 |
Advisories 14
- RHSA-2018:3680 Red Hat Security Advisory: rh-nginx112-nginx security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2018:3681 Red Hat Security Advisory: rh-nginx114-nginx security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2018:3652 Red Hat Security Advisory: rh-nginx18-nginx security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2018:3653 Red Hat Security Advisory: rh-nginx110-nginx security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-4335-1 nginx - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1572-1 nginx - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-3812-1 nginx vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2019:2309-1 Security update for nginx SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:0334-1 Security update for nginx SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:2120-1 Security update for nginx SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11092-1 nginx-1.21.3-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:0195-1 Security update for nginx SUSE / openSUSE Security Updates · May 7, 2025
- ELSA-2020-5862 Important: olcne nginx security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Sep 28, 2020
- ELSA-2020-5859 Important: olcne nginx security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Sep 24, 2020
References
- DSA-4335 vendor-advisory
- RHSA-2018:3680 vendor-advisory
- RHSA-2018:3681 vendor-advisory
- 105868 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16845
- 1042039 vdb-entry
- [debian-lts-announce] 20181108 [SECURITY] [DLA 1572-1] nginx security update mailing-list
- RHSA-2018:3653 vendor-advisory
- RHSA-2018:3652 vendor-advisory
- USN-3812-1 vendor-advisory
- http://mailman.nginx.org/pipermail/nginx-announce/2018/000221.html
- openSUSE-SU-2019:2120 vendor-advisory
- https://support.apple.com/kb/HT212818
- 20210921 APPLE-SA-2021-09-20-4 Xcode 13 mailing-list