CHT Security discovers a vulnerability in the nginx-http-flv-module live-streaming module

[Risk] Medium-High (Denial of Service, CVSS 3.1: 7.5)

[Affected] nginx-http-flv-module — all versions, including the latest v1.2.13

[Details]

Without any authentication, an attacker can send an HTTP/1.0 request with no Hostheader to an HTTP-FLV endpoint (flv_live on;), triggering a NULL pointer dereferencethat crashes the nginx worker process; sustained requests disconnect viewers anddegrade the live-streaming service. The flaw is classified as CWE-476 and maps toOWASP Top 10 2021 A06 - Vulnerable and Outdated Components.

[Remediation]

Recommended measures:

Users: configure nginx to reject requests with no Host header (e.g. return HTTP 400),or place the streaming endpoint behind a reverse proxy / WAF that enforces a validHost header; apply the official fix once released.

[Reporter] TaiYou (CHT Security)