Skip to content
English
  • There are no suggestions because the search field is empty.

Wowza Streaming Engine 4.12.2: Security Fixes, Upgrade Guidance, and New Security Advisories

Wowza Streaming Engine 4.12.2 Introduces Critical Security Fixes & A New Security Advisories Page

Wowza Streaming Engine 4.12.2 is now available. This release focuses on security hardening and resolves four CVEs in bundled components. Wowza recommends updating all Wowza Streaming Engine deployments to 4.12.2.

What’s in 4.12.2

  • Apache Tomcat updated to 10.1.61, resolving CVE-2026-101356 and CVE-2026-101296
  • An updated bundled Java runtime with the distrusted eMudhra emSign root certificates removed, resolving CVE-2026-91403 and CVE-2026-114820
  • Hardened defaults: SharedObject access is denied by default, XML files and REST API requests that contain a DOCTYPE are rejected, and the shutdown command interface only accepts signed stop commands from the local host
  • Fixes for missing HLS captions, blank subtitle track titles, WebRTC playback failures with certain application names or SecureToken on edge applications, and update tool permission changes on non-root servers

Full details & release notes: Wowza Streaming Engine 4.12.2 Release Notes

Before Updating

Some of the security changes can affect existing setups. Review the Security section of the release notes before upgrading, and check these items first:

  • Unreadable Application.xml files. Search the server logs for “Error parsing application config file.” An application whose Application.xml can’t be read or parsed no longer starts on default settings.
  • Command interface and SharedObject use. Tools that send commands other than stop to the command interface on port 8083 no longer work. Applications that rely on SharedObject read or write access may need configuration changes.
  • The Java runtime update. The update tool doesn’t replace the installed Java runtime. Installations updated with the tool need the new runtime installed manually, using the steps in the release notes, to resolve the two Java CVEs. Docker images aren’t affected.

How to Update

  • Customers with an active Maintenance and Support (M&S) subscription can update to 4.12.2 at no additional cost. Get the latest version through Wowza Support. 
    • Don’t have an active Maintenance and Support (M&S) subscription?
      Contact Customer Support for help with renewal and download access.
  • Teams on older versions can read about what each recent release adds in security, stability, and capability in Why You Should Keep Wowza Streaming Engine Up to Date.
  • For help migrating workflows, custom modules, or older deployments, you can work with certified Wowza engineers through Wowza Design Center.

New: Security Advisories Page

Wowza now publishes Wowza Streaming Engine security advisories in one place. Each advisory includes its severity, publish date, and update history. View them on the Wowza Streaming Engine Security Advisories page.