CVE-2026-32647
published 2026-03-24CVE-2026-32647: NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or…
PriorityP350high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.92%
56.6th percentile
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or over-write to the NGINX worker memory resulting in its termination or possibly code execution, using a specially crafted MP4 file. This issue affects NGINX Open Source and NGINX Plus if it is built with the ngx_http_mp4_module module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted MP4 file with the ngx_http_mp4_module module.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected
32 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | nginx | < nginx 1.28.3-1 (forky) | nginx 1.28.3-1 (forky) |
| f5 | nginx | >= 0 < 1.28.3-r0 | 1.28.3-r0 |
| f5 | nginx | >= 0 < 1.28.3-r0 | 1.28.3-r0 |
| f5 | nginx | >= 0 < 1.28.3-1 | 1.28.3-1 |
| f5 | nginx_open_source | — | — |
| f5 | nginx_open_source | >= 1.1.19 < 1.28.3 | 1.28.3 |
| f5 | nginx_open_source | >= 1.29.0 < 1.29.7 | 1.29.7 |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | >= R32 < R32 P5 | R32 P5 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.08.5HIGHCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv8.5HIGH
vendor_debian8.5HIGH
vendor_redhat8.5HIGH
vendor_msrc7.8HIGH
vendor_ubuntu6.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
nginx vulnerabilities
vendor_ubuntu·2026-06-03·CVSS 6.3
CVE-2026-1642 [MEDIUM] nginx vulnerabilities
Title: nginx vulnerabilities
Summary: Several security issues were fixed in nginx.
It was discovered that the nginx ngx_mail_smtp_module module incorrectly
handled certain memory operations when doing SMTP authentication. This
could possibly result in sensitive information being sent to the
authentication server. (CVE-2025-53859)
It was discovered that nginx incorrectly handled proxying to upstream TLS
servers. An attacker could possibly use this issue to insert plain text
data into the response from an upstream proxied server. (CVE-2026-1642)
It was discovered that the nginx ngx_mail_auth_http_module module
incorrectly handled certain requests. An attacker could possibly use this
issue to cause nginx to crash, resulting in a denial of service.
(CVE-2026-27651)
It was discovered that
Red Hat
nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files
vendor_redhat·2026-03-24·CVSS 8.5
CVE-2026-32647 [HIGH] CWE-125 nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files
nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or over-write to the NGINX worker memory resulting in its termination or possibly code execution, using a specially crafted MP4 file. This issue affects NGINX Open Source and NGINX Plus if it is built with the ngx_http_mp4_module module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted MP4 file with the ngx_http_mp4_module module.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
A flaw was found in NGINX'
F5
CVE-2026-32647: NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacke...
vendor_f5·2026-03-24·CVSS 7.8
CVE-2026-32647 [HIGH] CWE-125 CVE-2026-32647: NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacke...
CVE-2026-32647: NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacke...
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or over-write to the NGINX worker memory resulting in its termination or possibly code execution, using a specially crafted MP4 file. This issue affects NGINX Open Source and NGINX Plus if it is built with the ngx_http_mp4_module module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted MP4 file with the ngx_http_mp4_module module.
Note: Software versions which have reached End of Technical Supp
Microsoft
NGINX ngx_http_mp4_module vulnerability
vendor_msrc·2026-03-10·CVSS 7.8
CVE-2026-32647 [HIGH] CWE-125 NGINX ngx_http_mp4_module vulnerability
NGINX ngx_http_mp4_module vulnerability
Mariner: Mariner
f5: f5
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade
Debian
CVE-2026-32647: nginx - NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module...
vendor_debian·2026·CVSS 8.5
CVE-2026-32647 [HIGH] CVE-2026-32647: nginx - NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module...
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or over-write to the NGINX worker memory resulting in its termination or possibly code execution, using a specially crafted MP4 file. This issue affects NGINX Open Source and NGINX Plus if it is built with the ngx_http_mp4_module module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted MP4 file with the ngx_http_mp4_module module. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 1.28.3-1)
sid: resolved (fixed in 1.28.3-
OSV
CVE-2026-32647: NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read o
osv·2026-03-24·CVSS 8.5
CVE-2026-32647 [HIGH] CVE-2026-32647: NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read o
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or over-write to the NGINX worker memory resulting in its termination or possibly code execution, using a specially crafted MP4 file. This issue affects NGINX Open Source and NGINX Plus if it is built with the ngx_http_mp4_module module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted MP4 file with the ngx_http_mp4_module module. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
GHSA
GHSA-6364-x4qj-7w59: NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read o
ghsa_unreviewed·2026-03-24
CVE-2026-32647 [HIGH] CWE-125 GHSA-6364-x4qj-7w59: NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read o
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or over-write to the NGINX worker memory resulting in its termination or possibly code execution, using a specially crafted MP4 file. This issue affects NGINX Open Source and NGINX Plus if it is built with the ngx_http_mp4_module module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted MP4 file with the ngx_http_mp4_module module.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
OSV
CVE-2026-32647: NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read o
osv·2026-03-24·CVSS 8.5
CVE-2026-32647 [HIGH] CVE-2026-32647: NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read o
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or over-write to the NGINX worker memory resulting in its termination or possibly code execution, using a specially crafted MP4 file. This issue affects NGINX Open Source and NGINX Plus if it is built with the ngx_http_mp4_module module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted MP4 file with the ngx_http_mp4_module module.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
No detection rules found.
No public exploits indexed.
Hackernews
⚡ Weekly Recap: Telecom Sleeper Cells, LLM Jailbreaks, Apple Forces U.K. Age Checks and More
blogs_hackernews·2026-03-30·CVSS 9.3
[CRITICAL] ⚡ Weekly Recap: Telecom Sleeper Cells, LLM Jailbreaks, Apple Forces U.K. Age Checks and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Telecom Sleeper Cells, LLM Jailbreaks, Apple Forces U.K. Age Checks and More
Some weeks are loud. This one was quieter but not in a good way. Long-running operations are finally hitting courtrooms, old attack methods are showing up in new places, and research that stopped being theoretical right around the time defenders stopped paying attention.
There's a bit of everything this week. Persistence plays, legal wins, influence ops, and at least one thing that looks boring until you see what it connects to.
All of it below. Let's go.
## ⚡ Threat of the Week
Citrix Flaw Comes Under Active Exploitation — A cr
Wiz
CVE-2026-27651 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.7
CVE-2026-27651 [HIGH] CVE-2026-27651 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-27651 :
NGINX vulnerability analysis and mitigation
When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to terminate. This issue may occur when (1) CRAM-MD5 or APOP authentication is enabled, and (2) the authentication server permits retry by returning the Auth-Wait response header. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Source : NVD
## 8.7
Score
Published March 24, 2026
Severity HIGH
CNA Score 8.7
Affected Technologies
NGINX
Nginx Plus
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 12.5
Exploitation Probability (EPSS) N/A
Affected
Wiz
CVE-2026-27784 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.8
CVE-2026-27784 [HIGH] CVE-2026-27784 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-27784 :
NGINX vulnerability analysis and mitigation
The 32-bit implementation of NGINX Open Source has a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to over-read or over-write NGINX worker memory resulting in its termination, using a specially crafted MP4 file. The issue only affects 32-bit NGINX Open Source if it is built with the ngx_http_mp4_module module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted MP4 file with the ngx_http_mp4_module module.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Source : NVD
## 8.5
Score
Published March 24, 2026
Severity HIGH
CNA Score 8.
Wiz
CVE-2026-27654 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.8
CVE-2026-27654 [HIGH] CVE-2026-27654 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-27654 :
NGINX vulnerability analysis and mitigation
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this vulnerability may result in termination of the NGINX worker process or modification of source or destination file names outside the document root. This issue affects NGINX Open Source and NGINX Plus when the configuration file uses DAV module MOVE or COPY methods, prefix location (nonregular expression location configuration), and alias directives. The integrity impact is constrained because the NGINX worker process user has low privileges and does not have access to the entire system. Note: Software versions which have reached End of Technical Sup
Wiz
CVE-2026-1642 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.2
CVE-2026-1642 [HIGH] CVE-2026-1642 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-1642 :
NGINX vulnerability analysis and mitigation
A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Source : NVD
## 8.2
Score
Published February 4, 2026
Severity HIGH
CNA Score 8.2
Affected Technologies
NGINX
Rocky Linux
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 3.4
Exploitation
Wiz
CVE-2026-32647 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.5
CVE-2026-32647 [HIGH] CVE-2026-32647 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-32647 :
NGINX vulnerability analysis and mitigation
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or over-write to the NGINX worker memory resulting in its termination or possibly code execution, using a specially crafted MP4 file. This issue affects NGINX Open Source and NGINX Plus if it is built with the ngx_http_mp4_module module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted MP4 file with the ngx_http_mp4_module module.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Source : NVD
## 8.5
Score
Published M
Wiz
CVE-2026-28753 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.8
CVE-2026-28753 [HIGH] CVE-2026-28753 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-28753 :
NGINX vulnerability analysis and mitigation
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, leading to potential request manipulation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Source : NVD
## 6.3
Score
Published March 24, 2026
Severity MEDIUM
CNA Score 6.3
Affected Technologies
NGINX
Nginx Plus
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 6.4
Exploitation Probability (EPSS) N/A
Affected packages and lib
Wiz
CVE-2026-28755 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.8
CVE-2026-28755 [HIGH] CVE-2026-28755 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-28755 :
NGINX vulnerability analysis and mitigation
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when configured with the ssl_verify_client on and ssl_ocsp on directives, allowing the TLS handshake to succeed even after an OCSP check identifies the certificate as revoked.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Source : NVD
## 5.3
Score
Published March 24, 2026
Severity MEDIUM
CNA Score 5.3
Affected Technologies
NGINX
Nginx Plus
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 2.5
Exploitation Probability (EPSS) N/A
Affec
Bugzilla
CVE-2026-32647 nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files [fedora-all]
bugzilla·2026-03-27·CVSS 8.5
CVE-2026-32647 [HIGH] CVE-2026-32647 nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files [fedora-all]
CVE-2026-32647 nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2026-4de4d247a0 (nginx-1.28.3-1.fc44, nginx-mod-brotli-1.0.0~rc-7.fc44, and 5 more) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-4de4d247a0
---
FEDORA-2026-4de4d247a0 (nginx-1.28.3-1.fc44, nginx-mod-brotli-1.0.0~rc-7.fc44, and 5 more) has been pushed to the Fedora 44 stable repository.
If problem still persists, please make note of it in this bug report.
Bugzilla
CVE-2026-32647 nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files
bugzilla·2026-03-20·CVSS 8.5
CVE-2026-32647 [HIGH] CVE-2026-32647 nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files
CVE-2026-32647 nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files
Out-of-Bounds Read/Write vulnerability in the ngx_http_mp4_module of NGINX Open Source and NGINX Plus. The flaw is caused by improper handling of specially crafted MP4 files during processing. When such a file is parsed, it can trigger a buffer over-read or overwrite in worker memory, leading to process termination or undefined behavior. This vulnerability can be exploited by a local authenticated attacker capable of supplying a malicious MP4 file, potentially causing denial-of-service or achieving code execution under certain conditions.
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 10
Via RHSA-2026:6906 https://access.redhat.com/errata/RHSA
https://my.f5.com/manage/s/article/K000160366https://access.redhat.com/errata/RHSA-2026:10065https://access.redhat.com/errata/RHSA-2026:13634https://access.redhat.com/errata/RHSA-2026:13680https://access.redhat.com/errata/RHSA-2026:13839https://access.redhat.com/errata/RHSA-2026:14836https://access.redhat.com/errata/RHSA-2026:15942https://access.redhat.com/errata/RHSA-2026:15943https://access.redhat.com/errata/RHSA-2026:15945https://access.redhat.com/errata/RHSA-2026:15966https://access.redhat.com/errata/RHSA-2026:6906https://access.redhat.com/errata/RHSA-2026:6907https://access.redhat.com/errata/RHSA-2026:6923https://access.redhat.com/errata/RHSA-2026:7002https://access.redhat.com/errata/RHSA-2026:7343https://access.redhat.com/errata/RHSA-2026:8346https://access.redhat.com/security/cve/CVE-2026-32647https://bugzilla.redhat.com/show_bug.cgi?id=2449598https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32647.json
2026-03-24
Published