# Wowza Streaming Engine 4.12.2 released: security hardening and bug fixes **URL:** \ **Category:** Wowza Streaming Engine\ **Tags:** webrtc, security, wowza-streaming-engine, rtp, rtsp\ **Created:** [November 2, 2026, 11:55am UTC](https://community.wowza.com/t/wowza-streaming-engine-4-12-2-released-security-hardening-and-bug-fixes/102870 "2026-11-02T11:55:48Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![Bernd\_Backhaus1](https://sea2.discourse-cdn.com/flex002/user_avatar/community.wowza.com/bernd_backhaus1/32/1328_2.png) [@Bernd\_Backhaus1](https://community.wowza.com/u/Bernd_Backhaus1)\ **Post date:** [November 2, 2026, 11:55am UTC](https://community.wowza.com/t/wowza-streaming-engine-4-12-2-released-security-hardening-and-bug-fixes/102870/1 "2026-11-02T11:55:48Z")
Wowza Streaming Engine™ 4.12.2 build 20261029155418 was released Oct 30, 2026. This release hardens security in various places, fixes captions and WebRTC related bugs, and introduces an RTP port range configuration option as well as RSTP auth configuration through WSE manager. **Java support:** Wowza Streaming Engine 4.12.2 is compiled using Java 17 (OpenJDK Java SE JRE 17.0.12). It can be used with Java versions 17 or 21. For more details, see [Java version information](https://www.wowza.com/docs/wowza-streaming-engine-4-9-7-release-notes#java-version-information). * * * ## Overview * * * **Security hardening.** This release focuses on security. SharedObject access is now denied by default, XML files and REST API requests that contain a DOCTYPE are rejected, the command interface used by the shutdown scripts only listens locally and only accepts the stop command, and applications with an unreadable `Application.xml` no longer start on default settings. Some of these changes can affect existing setups, so review the [Security](https://www.wowza.com/docs/wowza-streaming-engine-4-12-2-release-notes#security) section before you upgrade. **Updated Java runtime.** The installers bundle an updated Java runtime and a cleaned-up certificate trust store. The update tool doesn’t replace the installed Java runtime, so if you upgrade with it, follow the steps in the [Security](https://www.wowza.com/docs/wowza-streaming-engine-4-12-2-release-notes#security) section to install the new runtime. **Upgrade fixes.** Updates and rollbacks no longer change file owners or permissions, which previously broke servers running as a non-root user. **Captions and WebRTC fixes.** We fixed missing captions and blank subtitle track titles in HLS streams, and WebRTC playback failures with certain application names or with SecureToken on edge applications. ## Detailed list of changes * * * ### Improvements - **RTP port range:** The new `DatagramEndingPort` setting under `` in `Server.xml` (default `65535`) sets an upper limit on the UDP ports assigned for RTP. - **RTSP authentication:** The existing `rtspAuthenticationUseFullURI` MediaCaster property can now be configured in the stream file RTSP advanced settings in WSE Manager. ### Bug fixes - **Captions:** - Fixed a bug causing missing captions in HLS VOD streams when a SMIL file named its caption file in a `` element. - Fixed a bug causing missing captions or blank subtitle track titles in HLS streams when a caption file name or subtitle title contained certain characters. - **WebRTC:** Fixed a bug causing WebRTC playback to fail when the application name included an instance name, such as `live/_definst_`, or when SecureToken was enabled on an edge application. ### Security - **SharedObject access and storage:** - **XML parsing:** XML parsing is now done using the JDK’s XML parser and the bundled Apache Xerces library has been removed. WSE no longer loads external DTDs and entities. Configuration files, `.rso` files, and REST API XML request bodies that contain a DOCTYPE are now rejected. - **Application configuration errors:** An application no longer starts on built-in defaults when its `Application.xml` can’t be read or parsed. WSE logs the error, refuses connections, and tries again when the file changes or after 10 seconds. Before upgrading, search the server logs for `Error parsing application config file` to find affected applications. - **Command interface:** The command interface (port 8083) that the shutdown scripts use now listens on `127.0.0.1` by default, accepts only the server stop command, and requires an HMAC-SHA256 signature keyed with `Admin.guid`. The `commandInterfaceMessageSecure` property is no longer supported. Tools that send other commands or use the previous signature no longer work. To run more than one instance on a host, give each instance a different command interface `Port`. - **Outbound HTTP requests:** WSE now rejects request paths and header values that contain carriage-return, line-feed, or null characters. - **Azure images:** The Azure Windows marketplace images no longer include `conf\Admin.guid` or `conf\Server.guid`. Each new installation generates its own on first start. - **Update tool permissions:** Updates and rollbacks no longer change the owner or permissions of existing files. Previously, the update tool gave every file the owner of `lib/wms-server.jar`, which broke servers that run as a non-root user. - Updated Apache Tomcat to version 10.1.61 to resolve [CVE-2026-101356](https://www.cve.org/CVERecord?id=CVE-2026-101356) and [CVE-2026-101296](https://www.cve.org/CVERecord?id=CVE-2026-101296), along with the other security fixes in Apache Tomcat 10.1.60 and 10.1.61. - **Bundled Java runtime:** Updated the bundled Java runtime (Linux installers: Eclipse Temurin 21.0.13+9; Windows installer: Eclipse Temurin 21.0.12.1+1) and removed the distrusted eMudhra emSign root certificates from the Java trust store in the installers and Docker images, to resolve [CVE-2026-91403](https://www.cve.org/CVERecord?id=CVE-2026-91403) and [CVE-2026-114820](https://www.cve.org/CVERecord?id=CVE-2026-114820). The bundled Java runtime uses Eclipse Temurin’s current CA trust store, which no longer includes some older root certificates that the certificate authorities have retired. ## Known issues * * * For a detailed list of currently known issues, see [Known issues with Wowza Streaming Engine](https://www.wowza.com/docs/known-issues-with-wowza-streaming-engine "Known issues with Wowza Streaming Engine"). * * * **Bernd Backhaus** Technical Support Engineer **WOWZA** | _The **solution** you start with, the **partner** you scale with._ **[Manage your Support cases online](https://portal.wowza.com/account/support)** **Bookmark our** **[FAQ page](https://support.wowza.com/hc/en-us)** **Bookmark our** **[Status page](https://status.wowza.com/)** ![182x66.9749984741211](https://api-na1.hubspot.com/filemanager/api/v2/files/189182705952/signed-url-redirect?portalId=229276)