CVE-2024-7347

A flaw was found in the ngx_http_mp4_module module of Nginx. Processing a specially crafted MP4 file can trigger a buffer over-read and cause the nginx process to terminate, resulting in a denial of service.

This issue only affects configurations with the ngx_http_mp4_module module loaded and being used. Additionally, to exploit this flaw, an attacker must be able to send and process a specially crafted MP4 file with the ngx_http_mp4_module module.

This module can be disable via the configuration file if its functionality is not needed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict publishing of audio and video to trusted users only.