EUVD-2026-112490
GHSA-c237-3r77-c8g5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed OVT listener
-
DeliverySend OVT packet with payload_length >32750
-
ExploitLoadHeader stalls awaiting bytes
-
ExecutionConnection held open, memory accumulates
-
ImpactOrigin-to-edge relay disrupted
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must be able to reach OvenMediaEngine's OVT listener (the origin-to-edge clustering endpoint) and send a crafted OVT packet whose header payload_length field exceeds 32750; no authentication, user interaction, or special client state is required (PR:N/UI:N). The practical limiting factor is network exposure of the OVT listener: in clustered deployments OVT typically runs between origin and edge nodes on an internal/trusted network, so internet-facing exploitation requires that the OVT listener be externally reachable, and single-node installations not using origin-edge clustering may not expose it at all. Affected: OvenMediaEngine through 0.21.0; impact is availability-only (stalled connections and accumulating buffered memory disrupting stream relay). |
| Impact | The input CVSS 4.0 score is 8.7 (high), driven by a clean remote, unauthenticated, low-complexity vector (AV:N/AC:L/AT:N/PR:N/UI:N) with impact confined to availability (VA:H; no confidentiality or integrity effect), consistent with the CWE-770 unbounded-resource-consumption nature of the flaw. The decision signals are mixed but point to real-but-not-emergency priority: vuln.today assigns 'this_week', the vendor has a patch, and VulnCheck published an advisory, but the CVE is NOT in CISA KEV, no EPSS exploitation-probability score was supplied, and no confirmed working exploit is indicated - so there is no evidence of active or widespread exploitation. The main caveat is a data-consistency problem: the supplied patch commit diff (ce316146) touches codec-compatibility docs, audio channel-layout handling, and playlist track-id equality - it does NOT modify OvtPacket::LoadHeader() or any OVT packet-length handling described in the CVE, so the fix cannot be verified from the provided evidence. Net: a genuine unauthenticated remote DoS against OVT stream relay, prioritized for near-term patching rather than emergency action, with the real-world blast radius bounded by how exposed the OVT listener is. |
| Exploit ScenarioDerived | An attacker who can reach the OvenMediaEngine OVT listener sends a crafted OVT packet whose header advertises a payload_length above 32750. Because the vector is network-based, unauthenticated, and low-complexity (AV:N/AC:L/PR:N/UI:N), the connection stalls in OvtPacket::LoadHeader() waiting for bytes that never arrive, is held open indefinitely, and accumulates buffered memory, degrading or breaking origin-to-edge stream relay. No public exploit is identified in the supplied data, so this reflects the described mechanism rather than a confirmed released tool. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Unauthenticated denial of service in OvenMediaEngine through 0.21.0 lets a remote sender stall origin-to-edge stream relay by submitting crafted OVT packets whose header payload_length field exceeds 32750, holding connections open indefinitely while buffered memory accumulates. The flaw sits in OvtPacket::LoadHeader() in the OVT packetizer/depacketizer path (CWE-770, allocation of resources without limits or throttling); the assessed vector is AV:N/AC:L/PR:N/UI:N with availability-only impact, matching the 8.7 CVSS 4.0 score. Exploitability is bounded in practice by exposure: OVT is normally an internal origin-to-edge link, so internet-facing risk exists only where that listener is externally reachable. No public exploit code has been identified at time of analysis, and the vendor fix is referenced upstream (commit ce316146, issue #2330).
RemediationAI
Vendor-released patch: upstream fix commit ce316146d668a934217f25c777289ca256aa6786 in the OvenMediaEngine repository, referenced as the patch for issue #2330; the vendor states a patch is available, but no tagged release version containing the fix is confirmed in the supplied data, so operators should build from or upgrade to a release that includes that commit and verify the payload_length bound in ovt_packet.cpp LoadHeader before treating a deployment as fixed. Where an immediate upgrade is not possible, the practical compensating control is exposure reduction rather than code change: bind the OVT origin-to-edge listener to internal interfaces only, firewall it to known origin/edge peer addresses, and avoid publishing it through reverse proxies or public load balancers - the trade-off is that any edge node outside the allowed address set can no longer relay from the origin, and ad-hoc or cross-network edge nodes must be re-homed or tunnelled. There is no evidence in the supplied data of a configuration switch that caps payload_length or disables the OVT relay while keeping clustering functional, so blocking reachability to the listener is the only isolation lever supported by the evidence; monitor for a single source holding many long-lived OVT connections with growing per-connection buffers as a detection signal. Reference advisories: https://www.vulncheck.com/advisories/ovenmediaengine-through-0.21.0-ovt-relay-dos-via-oversized-payload-length and https://github.com/OvenMediaLabs/OvenMediaEngine/issues/2330.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OVT is OvenMediaEngine's own relay protocol, used to pass streams from an origin node to edge nodes in clustering deployments; the affected code is the packetizer's header parser (src/modules/ovt_packetizer/ovt_packet.cpp, lines 48-129, LoadHeader) with the corresponding depacketizer at src/modules/ovt_packetizer/ovt_depacketizer.cpp lines 32-53. The header carries a payload_length field, and values above 32750 are not rejected, so a sender can advertise a length the implementation then waits on and buffers rather than bounding. That is a classic CWE-770 (allocation of resources without limits or throttling) condition: the connection stays open, memory grows per stalled session, and the relay path degrades for legitimate origin-to-edge traffic. The CPE cpe:2.3:a:ovenmedialabs:ovenmediaengine is unversioned-bounded in the feed, but the description and advisory scope versions through 0.21.0. Note that the referenced fix commit ce316146 also carries changes to audio channel layout handling, track-id plumbing and clustering/WebRTC documentation; the excerpt available does not show the OVT header length check itself, so the exact patch content should be confirmed against the commit and issue #2330 rather than inferred from the diff excerpt.
Know when Ovenmediaengine gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remote, unauthenticated, low-complexity packet triggers resource exhaustion, so AV:N/AC:L/PR:N/UI:N; impact is availability-only (A:H) with no confidentiality or integrity effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
OvenMediaEngine through 0.21.0 contains a denial of service vulnerability in OvtPacket::LoadHeader() that allows unauthenticated attackers to stall connections by sending payload_length values above 32750. Attackers can send crafted OVT packets to the OVT listener to hold connections open indefinitely and accumulate buffered memory, disrupting origin-to-edge stream relay.
Executive ViewAI
CVE-2026-118689 is a high-severity unauthenticated denial-of-service vulnerability in OvenMediaEngine (through 0.21.0) that allows a remote attacker to stall origin-to-edge stream relay by sending crafted OVT packets, causing memory exhaustion and service disruption. This impacts streaming availability, potentially disrupting live broadcasts and internal operations, and is particularly concerning where OVT listeners are exposed to untrusted networks.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB