← Vulnerability feed

Vulnerability record · CVE-2022-37237 · published 30 August 2022

CVE-2022-37237: Zlmediakit vulnerability

ZZlmediakit · Zlmediakit

An attacker can send malicious RTMP requests to make the ZLMediaKit server crash remotely. Affected version is below commit 7d8b212a3c3368bc2f6507cb74664fc419eb9327.

7.5 CVSS 3.1 High EPSS 0.80% · top 45.2%
7.5CVSS 3.1 base score
0.80%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

An attacker can send malicious RTMP requests to make the ZLMediaKit server crash remotely. Affected version is below commit 7d8b212a3c3368bc2f6507cb74664fc419eb9327.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/ZLMediaKit/ZLMediaKit/issues/1839 Issue TrackingPatchThird Party Advisory
https://github.com/ZLMediaKit/ZLMediaKit/issues/1839 Issue TrackingPatchThird Party Advisory

Track CVE-2022-37237 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2026-35203Zlmediakit out-of-bounds read vulnerabilityZLMediaKit is a streaming media service framework. the VP9 RTP payload parser in ext-codec/VP9Rtp.cpp reads multiple fields from the RTP payload base…EPSS 0.52%7.5CVE-2023-31861Zlmediakit path traversal vulnerabilityZLMediaKit 4.0 is vulnerable to Directory Traversal.EPSS 1.1%6.1CVE-2023-39067Zlmediakit cross-site scripting vulnerabilityCross Site Scripting vulnerability in ZLMediaKiet v.4.0 and v.5.0 allows an attacker to execute arbitrary code via a crafted script to the URL.EPSS 0.40%

Source: NIST National Vulnerability Database (record CVE-2022-37237), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.