CVE-2026-27784 — Integer Overflow or Wraparound in F5 Nginx Open Source
Severity
8.5HIGHNVD
EPSS
0.0%
top 98.21%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 24
Description
The 32-bit implementation of NGINX Open Source has a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to over-read or over-write NGINX worker memory resulting in its termination, using a specially crafted MP4 file. The issue only affects 32-bit NGINX Open Source if it is built with the ngx_http_mp4_module module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially …
CVSS vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected Packages4 packages
🔴Vulnerability Details
4OSV▶
CVE-2026-27784: The 32-bit implementation of NGINX Open Source has a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to over-read or ov↗2026-03-24
GHSA▶
GHSA-hwq5-42j9-jvqj: The 32-bit implementation of NGINX Open Source has a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to over-read or ov↗2026-03-24
OSV▶
CVE-2026-27784: The 32-bit implementation of NGINX Open Source has a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to over-read or ov↗2026-03-24
📋Vendor Advisories
4🕵️Threat Intelligence
1💬Community
1Bugzilla▶
CVE-2026-27784 NGINX: NGINX: Denial of Service due to memory corruption via crafted MP4 file↗2026-03-24