Subject: Wowza Voice of the Customer: Important Security Updates
Hello Wowza Community!
October was a busy month for security across the technology industry, with several significant vulnerabilities and CVEs requiring organizations to review their environments and take steps to mitigate potential risks.
At Wowza, the security of our products and the customers who depend on them remains a top priority. We’ve been working closely across our Product, Engineering, and Security teams to address recently identified vulnerabilities, strengthen our products, and improve how we communicate important security information to our customers.
As part of that effort, we’ve introduced several important updates:
1. Wowza Streaming Engine 4.12.2
We’ve released Wowza Streaming Engine 4.12.2, which addresses recently identified security vulnerabilities and includes additional security enhancements designed to better protect your streaming environments.
We strongly encourage all customers running Wowza Streaming Engine to review the release notes and upgrade to version 4.12.2.
2. New Wowza Security Advisories Portal
We’ve launched a centralized security advisories page to provide customers with a single location for the latest security information, including identified vulnerabilities, affected versions, remediation guidance, and ongoing updates.
This will be a living resource that we’ll continue to maintain as new information becomes available.
3. Proactive Security Notifications
We’re also expanding how we communicate important security updates. Through our status page, customers can subscribe to notifications to stay informed about relevant security announcements and product updates.
Our goal is simple: make it easier for you to stay informed and take action when needed.
Our Commitment to You
Security isn’t something we address only when a vulnerability is discovered. It’s an ongoing responsibility, and one we take seriously.
We recognize that many of you rely on Wowza to power critical streaming workflows, and we want you to have confidence in both the technology and the team supporting it.
For additional information, including details on the latest release and recommended actions, please review our official security announcement:
Wowza Streaming Engine 4.12.2 Introduces Critical Security Fixes & A New Security Advisories Page
Wowza Streaming Engine 4.12.2 is now available. This release focuses on security hardening and resolves four CVEs in bundled components. Wowza recommends updating all Wowza Streaming Engine deployments to 4.12.2.
What’s in 4.12.2
- Apache Tomcat updated to 10.1.61, resolving CVE-2026-101356 and CVE-2026-101296
- An updated bundled Java runtime with the distrusted eMudhra emSign root certificates removed, resolving CVE-2026-91403 and CVE-2026-114820
- Hardened defaults: SharedObject access is denied by default, XML files and REST API requests that contain a DOCTYPE are rejected, and the shutdown command interface only accepts signed stop commands from the local host
- Fixes for missing HLS captions, blank subtitle track titles, WebRTC playback failures with certain application names or SecureToken on edge applications, and update tool permission changes on non-root servers
Full details & release notes are here: Wowza Streaming Engine 4.12.2 release notes | Wowza Docs & APIs
Before Updating:
Some of the security changes can affect existing setups. Review the Security section of the release notes before upgrading, and check these items first:
- Unreadable Application.xml files. Search the server logs for “Error parsing application config file.” An application whose Application.xml can’t be read or parsed no longer starts on default settings.
- Command interface and SharedObject use. Tools that send commands other than stop to the command interface on port 8083 no longer work. Applications that rely on SharedObject read or write access may need configuration changes.
- The Java runtime update. The update tool doesn’t replace the installed Java runtime. Installations updated with the tool need the new runtime installed manually, using the steps in the release notes, to resolve the two Java CVEs. Docker images aren’t affected.
How to Update:
- Customers with an active Maintenance and Support (M&S) subscription can update to 4.12.2 at no additional cost. Get the latest version through Wowza Support: Get Wowza Support for Our Products and Services | Wowza
- Teams on older versions can read about what each recent release adds in security, stability, and capability: Why Should You Keep Wowza Streaming Engine Up-To-Date? | Wowza . For help migrating workflows, custom modules, or older deployments, you can work with certified Wowza engineers through Wowza Design Center: Wowza Design Center | Wowza
New: Security Advisories Page
Wowza now publishes Wowza Streaming Engine security advisories in one place. Each advisory includes its severity, publish date, and update history: Security advisories | Wowza Docs & APIs
As always, we welcome your feedback and encourage you to reach out to our Support team if you have questions or need assistance.
Thank you for being part of the Wowza Community!
