PT-2026-27431 · Nginx+4 · Nginx Open Source+5

Published 2026-03-24 · Updated 2026-05-20 · CVE-2026-27784

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NGINX Open Source (affected versions not specified)

Description The 32-bit implementation of NGINX Open Source contains an issue within the ngx http mp4 module module. This can allow an attacker to read from or write to NGINX worker memory, potentially causing the service to terminate. The issue requires a specially crafted MP4 file to be processed by the ngx http mp4 module module. This is only possible if the NGINX Open Source installation is 32-bit, built with the ngx http mp4 module module, and the mp4 directive is used in the configuration file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

ALSA-2026:6906

ALSA-2026:6907

ALSA-2026:6923

ALSA-2026:7002

ALSA-2026:7343

BDU:2026-04818

BIT-NGINX-2026-27784

BIT-NGINX-GATEWAY-2026-27784

CVE-2026-27784

OPENSUSE-SU-2026:10423-1

RHSA-2026:13680

RHSA-2026:13839

RHSA-2026:14836

RHSA-2026:6906

RHSA-2026:6907

RHSA-2026:6923

RHSA-2026:7002

RHSA-2026:7343

RHSA-2026:8346

USN-8210-1

Affected Products

Linuxmint

Nginx Open Source

Nginx

Red Os

Rocky Linux

Ubuntu

References · 71

• https://osv.dev/vulnerability/ALSA-2026:7343 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2026:7343 · Vendor Advisory
• https://errata.almalinux.org/10/ALSA-2026-6906.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-27784 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:6907 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2026-7343.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-27654 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8210-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2026-6907.html · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-27784 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:6906 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-32647 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-27784 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27784 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2026-27784 · Vendor Advisory