CVE-2026-118689 Details
Description
OvenMediaEngine through 0.21.0 contains a denial of service vulnerability in OvtPacket::LoadHeader() that allows unauthenticated attackers to stall connections by sending payload_length values above 32750. Attackers can send crafted OVT packets to the OVT listener to hold connections open indefinitely and accumulate buffered memory, disrupting origin-to-edge stream relay.
A denial-of-service vulnerability has been identified in OvenMediaEngine versions through 0.21.0. The issue arises in the OVT packet handling, specifically within the OvtPacket::LoadHeader() function. When the payload_length field of OVT packets exceeds 32750, the server fails to close or reject the connection. Instead, it keeps the connection open indefinitely, waiting for additional data that will never arrive. This flaw allows unauthenticated remote attackers to stall connections, exhaust available OVT relay slots, and disrupt the Origin-to-Edge stream delivery process.
The vulnerability has been addressed in OvenMediaEngine version 0.21.0. Users should update to this version to mitigate the issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 28, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/OvenMediaLabs/OvenMediaEngine/issues/2330 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/OvenMediaLabs/OvenMediaEngine | [email protected] | Vendor |
| https://github.com/OvenMediaLabs/OvenMediaEngine/blob/v0.21.0/src/modules/ovt_packetizer/ovt_depacketizer.cpp#L32-L53 | [email protected] | Source CodeVendor |
| https://github.com/OvenMediaLabs/OvenMediaEngine/blob/v0.21.0/src/modules/ovt_packetizer/ovt_packet.cpp#L48-L129 | [email protected] | Source CodeVendor |
| https://github.com/OvenMediaLabs/OvenMediaEngine/commit/ce316146d668a934217f25c777289ca256aa6786 | [email protected] | Source CodeVendor |
| https://github.com/OvenMediaLabs/OvenMediaEngine/issues/2330 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/ovenmediaengine-through-0.21.0-ovt-relay-dos-via-oversized-payload-length | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OvenMediaLabs OvenMediaEngine | <= 0.21.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Oct 28, 2026 | New CVE Received | [email protected] |