Skip to content
Fencer Intel
high 7.0

CVE-2022-41741 json

NGINX ngx_http_mp4_module vulnerability CVE-2022-41741

published 4y ago modified last mo. also BIT-nginx-2022-41741 , BIT-nginx-ingress-controller-2022-41741 , EUVD-2022-44912

cvss
7.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 57%
public exploits
0
none known

Summary

NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to corrupt NGINX worker memory, resulting in its termination or potential other impact using a specially crafted audio or video file. The issue affects only NGINX products that are built with the ngx_http_mp4_module, when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_mp4_module.

Patch / fix

  • bitnami nginx 1.22.1, 1.23.2
  • bitnami nginx-ingress-controller 1.12.4, 2.4.0
  • F5 NGINX 1.22.1, 1.23.2
  • F5 NGINX Plus R26-p1, R27-p1
  • F5 NGINX Open Source Subscription R1 P1, R2 P1
  • nginx Debian 14, Debian 13, Debian 12 1.22.1-1

debian advisories DEBIAN-CVE-2022-41741

  • nginx Ubuntu 18.04 LTS 1.14.0-0ubuntu1.11
  • nginx Ubuntu 20.04 LTS 1.18.0-0ubuntu1.4
  • nginx Ubuntu 22.04 LTS 1.18.0-6ubuntu14.3
  • nginx Ubuntu Pro 14.04 LTS 1.4.6-1ubuntu3.9+esm4
  • nginx Ubuntu Pro 16.04 LTS 1.10.3-0ubuntu0.16.04.5+esm5

ubuntu advisories UBUNTU-CVE-2022-41741

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • nginx RHEL 9 2:1.20.1-22.el9_6.2
  • nginx-core RHEL 9 2:1.20.1-22.el9_6.2
  • nginx-mod-mail RHEL 9 2:1.20.1-22.el9_6.2
  • nginx-filesystem RHEL 9 2:1.20.1-22.el9_6.2
  • nginx-mod-stream RHEL 9 2:1.20.1-22.el9_6.2
  • nginx-all-modules RHEL 9 2:1.20.1-22.el9_6.2
  • nginx-mod-http-perl RHEL 9 2:1.20.1-22.el9_6.2
  • nginx-mod-http-xslt-filter RHEL 9 2:1.20.1-22.el9_6.2

red hat advisories RHSA-2025:7619RHSA-2025:7546RHSA-2025:7402

  • nginx SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLE High Performance Computing 15 SP1-LTSS +1 more 1.16.1-150100.6.19.1
  • nginx SLE Module for Server Applications 15 SP4, openSUSE Leap 15.4 1.21.5-150400.3.3.1
  • nginx SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLE High Performance Computing 15 SP2-LTSS +1 more 1.16.1-150200.3.12.1
  • nginx SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Real Time 15 SP3 +7 more 1.19.8-150300.3.12.1

suse advisories SUSE-SU-2023:0293-1SUSE-SU-2023:0212-1SUSE-SU-2023:0210-1SUSE-SU-2023:0205-1

  • nginx openSUSE Tumbleweed 1.23.2-1.1

opensuse advisories openSUSE-SU-2024:12433-1

  • nginx AlmaLinux 9 2:1.20.1-22.el9_6.2.alma.1
  • nginx-core AlmaLinux 9 2:1.20.1-22.el9_6.2.alma.1
  • nginx-mod-mail AlmaLinux 9 2:1.20.1-22.el9_6.2.alma.1
  • nginx-filesystem AlmaLinux 9 2:1.20.1-22.el9_6.2.alma.1
  • nginx-mod-stream AlmaLinux 9 2:1.20.1-22.el9_6.2.alma.1
  • nginx-all-modules AlmaLinux 9 2:1.20.1-22.el9_6.2.alma.1
  • nginx-mod-http-perl AlmaLinux 9 2:1.20.1-22.el9_6.2.alma.1
  • nginx-mod-http-xslt-filter AlmaLinux 9 2:1.20.1-22.el9_6.2.alma.1

almalinux advisories ALSA-2025:7402

  • nginx Rocky Linux 9 2:1.20.1-22.el9_6.2

rocky linux advisories RLSA-2025:7402

  • nginx Alpine 3.24, Alpine 3.23, Alpine 3.22 +6 more 1.22.1-r0

alpine advisories ALPINE-CVE-2022-41741

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • nginx CBL-Mariner 2.0 1.22.1-1

azure linux advisories AZL-11320

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2022-41741 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-41741 updated cvss 7.8

nginx: Memory corruption in the ngx_http_mp4_module

  • Red Hat Ansible Automation Platform 1.2 nginx
    affected: workaround, no fix available “A mitigation for this vulnerability would be to disable the ngx_http_mp4_module module in your local Nginx environment.”
  • Red Hat Enterprise Linux 8 nginx, nginx-mod-mail, nginx-filesystem, nginx-mod-stream, nginx-all-modules, nginx-mod-http-perl, +2 more Red Hat Software Collections rh-nginx118-nginx, rh-nginx120-nginx, rh-nginx118-nginx-mod-mail, rh-nginx120-nginx-mod-mail, rh-nginx118-nginx-mod-stream, rh-nginx120-nginx-mod-stream, +6 more
    affected: workaround, no fix planned “A mitigation for this vulnerability would be to disable the ngx_http_mp4_module module in your local Nginx environment.”
  • Red Hat CodeReady Linux Builder EUS (v.9.2) nginx-debuginfo 1.20.1-14.el9_2.3, nginx-mod-devel 1.20.1-14.el9_2.3, nginx-debugsource 1.20.1-14.el9_2.3, nginx-core-debuginfo 1.20.1-14.el9_2.3, nginx-mod-mail-debuginfo 1.20.1-14.el9_2.3, nginx-mod-stream-debuginfo 1.20.1-14.el9_2.3, +3 more
    fixed: vendor fix “A mitigation for this vulnerability would be to disable the ngx_http_mp4_module module in your local Nginx environment.” RHSA-2025:7546
  • Red Hat CodeReady Linux Builder EUS (v.9.4) nginx-debuginfo 1.20.1-16.el9_4.3, nginx-mod-devel 1.20.1-16.el9_4.3, nginx-debugsource 1.20.1-16.el9_4.3, nginx-core-debuginfo 1.20.1-16.el9_4.3, nginx-mod-mail-debuginfo 1.20.1-16.el9_4.3, nginx-mod-stream-debuginfo 1.20.1-16.el9_4.3, +3 more
    fixed: vendor fix “A mitigation for this vulnerability would be to disable the ngx_http_mp4_module module in your local Nginx environment.” RHSA-2025:7619
  • Red Hat Enterprise Linux AppStream (v. 9) nginx 1.20.1-22.el9_6.2, nginx-core 1.20.1-22.el9_6.2, nginx-mod-mail 1.20.1-22.el9_6.2, nginx-filesystem 1.20.1-22.el9_6.2, nginx-mod-stream 1.20.1-22.el9_6.2, nginx-all-modules 1.20.1-22.el9_6.2, +3 more
    fixed: vendor fix “A mitigation for this vulnerability would be to disable the ngx_http_mp4_module module in your local Nginx environment.” RHSA-2025:7402
  • Red Hat Enterprise Linux AppStream EUS (v.9.2) nginx 1.20.1-14.el9_2.3, nginx-core 1.20.1-14.el9_2.3, nginx-mod-mail 1.20.1-14.el9_2.3, nginx-filesystem 1.20.1-14.el9_2.3, nginx-mod-stream 1.20.1-14.el9_2.3, nginx-all-modules 1.20.1-14.el9_2.3, +3 more
    fixed: vendor fix “A mitigation for this vulnerability would be to disable the ngx_http_mp4_module module in your local Nginx environment.” RHSA-2025:7546
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) nginx 1.20.1-16.el9_4.3, nginx-core 1.20.1-16.el9_4.3, nginx-mod-mail 1.20.1-16.el9_4.3, nginx-filesystem 1.20.1-16.el9_4.3, nginx-mod-stream 1.20.1-16.el9_4.3, nginx-all-modules 1.20.1-16.el9_4.3, +3 more
    fixed: vendor fix “A mitigation for this vulnerability would be to disable the ngx_http_mp4_module module in your local Nginx environment.” RHSA-2025:7619
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) nginx-debuginfo 1.20.1-22.el9_6.2, nginx-mod-devel 1.20.1-22.el9_6.2, nginx-debugsource 1.20.1-22.el9_6.2, nginx-core-debuginfo 1.20.1-22.el9_6.2, nginx-mod-mail-debuginfo 1.20.1-22.el9_6.2, nginx-mod-stream-debuginfo 1.20.1-22.el9_6.2, +3 more
    fixed: vendor fix “A mitigation for this vulnerability would be to disable the ngx_http_mp4_module module in your local Nginx environment.” RHSA-2025:7402
show 1 more
  • Red Hat Ansible Automation Platform 2 nginx
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
last yr.

Exploit prediction

0.81% chance of exploitation in the next 30 days, higher than 57% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
OSV 3.1 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
OSV 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
bitnami nginx
>=1.1.3, <1.22.1
>=1.23.0, <1.23.2
1.22.1
1.23.2
bitnami nginx-ingress-controller
>=1.9.0, <1.12.4
>=2.0.0, <2.4.0
1.12.4
2.4.0

Affected products

  • F5 NGINX
  • F5 NGINX Plus
  • F5 NGINX Open Source Subscription

Classification

Weakness
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.