CVE-2026-118689: high-severity vulnerability in OvenMediaLabs OvenMediaEngine
OvenMediaEngine through 0.21.0 OVT Relay DoS via Oversized payload_length
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 0.5%
OvenMediaEngine through 0.21.0 contains a denial of service vulnerability in OvtPacket::LoadHeader() that allows unauthenticated attackers to stall connections by sending payload_length values above 32750. Attackers can send crafted OVT packets to the OVT listener to hold connections open indefinitely and accumulate buffered memory, disrupting origin-to-edge stream relay.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
OvenMediaLabs · OvenMediaEngineReferences
https://github.com/OvenMediaLabs/OvenMediaEnginehttps://github.com/OvenMediaLabs/OvenMediaEngine/blob/v0.21.0/src/modules/ovt_packetizer/ovt_depacketizer.cpp#L32-L53https://github.com/OvenMediaLabs/OvenMediaEngine/blob/v0.21.0/src/modules/ovt_packetizer/ovt_packet.cpp#L48-L129https://github.com/OvenMediaLabs/OvenMediaEngine/commit/ce316146d668a934217f25c777289ca256aa6786https://github.com/OvenMediaLabs/OvenMediaEngine/issues/2330https://www.vulncheck.com/advisories/ovenmediaengine-through-0.21.0-ovt-relay-dos-via-oversized-payload-length