Wowza Streaming Engine 4.12.2 release notes

Version: Wowza Streaming Engine™ 4.12.2 build 20261029155418 released Oct 30, 2026

Java support: Wowza Streaming Engine 4.12.2 is compiled using Java 17 (OpenJDK Java SE JRE 17.0.12). It can be used with Java versions 17 or 21. For more details, see Java version information.

Overview

---

Security hardening. This release focuses on security. SharedObject access is now denied by default, XML files and REST API requests that contain a DOCTYPE are rejected, the command interface used by the shutdown scripts only listens locally and only accepts the stop command, and applications with an unreadable Application.xml no longer start on default settings. Some of these changes can affect existing setups, so review the Security section before you upgrade.

Updated Java runtime. The installers bundle an updated Java runtime and a cleaned-up certificate trust store. The update tool doesn't replace the installed Java runtime, so if you upgrade with it, follow the steps in the Security section to install the new runtime.

Upgrade fixes. Updates and rollbacks no longer change file owners or permissions, which previously broke servers running as a non-root user.

Captions and WebRTC fixes. We fixed missing captions and blank subtitle track titles in HLS streams, and WebRTC playback failures with certain application names or with SecureToken on edge applications.

Detailed list of changes

---

Improvements

• RTP port range: The new DatagramEndingPort setting under <RTP> in Server.xml (default 65535) sets an upper limit on the UDP ports assigned for RTP.
• RTSP authentication: The existing rtspAuthenticationUseFullURI MediaCaster property can now be configured in the stream file RTSP advanced settings in WSE Manager.

Bug fixes

• Captions:
  • Fixed a bug causing missing captions in HLS VOD streams when a SMIL file named its caption file in a <textstream> element.
  • Fixed a bug causing missing captions or blank subtitle track titles in HLS streams when a caption file name or subtitle title contained certain characters.
• WebRTC: Fixed a bug causing WebRTC playback to fail when the application name included an instance name, such as live/_definst_, or when SecureToken was enabled on an edge application.

Security

• SharedObject access and storage:
  • SharedObject read and write access is denied by default. The SharedObject API is deprecated for removal in a future major version.
  • SharedObject files can only be written to and read from the application's SharedObject storage folder. WSE rejects names that can't be used as a path in that folder and no longer loads existing .rso files with those names.
  • New installations ship Application.xml templates with empty values for SharedObjectReadAccess and SharedObjectWriteAccess.
  • On upgrade, the update tool removes SharedObjectReadAccess and SharedObjectWriteAccess values of *.
• XML parsing: XML parsing is now done using the JDK's XML parser and the bundled Apache Xerces library has been removed. WSE no longer loads external DTDs and entities. Configuration files, .rso files, and REST API XML request bodies that contain a DOCTYPE are now rejected.
• Application configuration errors: An application no longer starts on built-in defaults when its Application.xml can't be read or parsed. WSE logs the error, refuses connections, and tries again when the file changes or after 10 seconds. Before upgrading, search the server logs for Error parsing application config file to find affected applications.
• Command interface: The command interface (port 8083) that the shutdown scripts use now listens on 127.0.0.1 by default, accepts only the server stop command, and requires an HMAC-SHA256 signature keyed with Admin.guid. The commandInterfaceMessageSecure property is no longer supported. Tools that send other commands or use the previous signature no longer work. To run more than one instance on a host, give each instance a different command interface Port.
• Outbound HTTP requests: WSE now rejects request paths and header values that contain carriage-return, line-feed, or null characters.
• Azure images: The Azure Windows marketplace images no longer include conf\Admin.guid or conf\Server.guid. Each new installation generates its own on first start.
• Update tool permissions: Updates and rollbacks no longer change the owner or permissions of existing files. Previously, the update tool gave every file the owner of lib/wms-server.jar, which broke servers that run as a non-root user.
• Updated Apache Tomcat to version 10.1.61 to resolve CVE-2026-101356 and CVE-2026-101296, along with the other security fixes in Apache Tomcat 10.1.60 and 10.1.61.
• Bundled Java runtime: Updated the bundled Java runtime (Linux installers: Eclipse Temurin 21.0.13+9; Windows installer: Eclipse Temurin 21.0.12.1+1) and removed the distrusted eMudhra emSign root certificates from the Java trust store in the installers and Docker images, to resolve CVE-2026-91403 and CVE-2026-114820. The bundled Java runtime uses Eclipse Temurin's current CA trust store, which no longer includes some older root certificates that the certificate authorities have retired.

  The update tool doesn't replace the installed Java runtime, so an installation updated with it keeps its current runtime until you replace it with the one in the update package. Docker images don't use the bundled Java runtime and aren't affected. Don't copy the new runtime over the existing jre folder: that leaves old files behind and can fail on read-only files. Instead:

  1. Stop the Wowza Streaming Engine and Wowza Streaming Engine Manager services.
  2. Rename [install-dir]/jre to jre.bak. Keeping it allows a rollback. On Linux, as root from the update's linux folder: mv ../../../jre ../../../jre.bak. On Windows, in an elevated command prompt from the update's windows folder: ren ..\..\..\jre jre.bak
  3. Copy the matching folder from the update package (jre/linux-x64, jre/linux-aarch64 or jre/windows-x64) to [install-dir]/jre. On Linux: cp -r ../jre/linux-x64 ../../../jre (linux-aarch64 on ARM64), then chmod 755 ../../../jre/bin/* ../../../jre/lib/jspawnhelper to restore execute permissions that the update package doesn't keep. On Windows: xcopy ..\jre\windows-x64 ..\..\..\jre /E /I
  4. Start the services.

Known issues

---

For a detailed list of currently known issues, see Known issues with Wowza Streaming Engine.