Kore CVE-2026-121727

No special conditions - remote unauthenticated exploitation against default configurations of the Kore web server/framework before 4.3.0, provided the server accepts request bodies (POST, PUT or DELETE), which is standard HTTP handling. The practical limiting factor is scale rather than access: a single request is harmless, so the attacker must open and sustain many concurrent connections, each sending a first body segment larger than its declared Content-Length, to drive unbounded buffer growth and exhaust worker memory. No authentication, user interaction, or non-default setting is required. The condition is fully removed by upgrading to Kore 4.3.0.

All signals describe a genuine but availability-only threat. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:N/VI:N/VA:H) marks this as remotely reachable, low-complexity, unauthenticated, and requiring no user interaction, but with impact confined to availability - no confidentiality or integrity loss, consistent with the described worker-memory exhaustion. The vuln.today decision label is 'this_week', not 'act_now' or 'emergency', so this should be prioritized for near-term patching rather than treated as a fire-drill. No EPSS score, no CISA KEV listing, and no public exploit were provided; absence of these is not evidence of safety, but it indicates no confirmed in-the-wild activity at analysis time. The CVSS vector and the description agree (both point to unauthenticated remote resource exhaustion), so there is no network-vs-local conflict here. The main caveat is tag quality: the input tags label this an 'Authentication Bypass', which is incorrect - the flaw bypasses the http_body_max size limit, not authentication, and the real impact is denial of service, so severity should be read as a DoS risk for internet-facing Kore servers rather than as a breach path.

An attacker opens many concurrent POST, PUT or DELETE connections to an internet-facing Kore server (before 4.3.0), each sending a first body segment larger than its declared Content-Length; an unsigned integer underflow wraps content_length to a huge value, bypassing the http_body_max check. Repeated across many connections, per-connection buffers grow without bound and exhaust the worker process memory, causing denial of service. No public exploit code is identified at time of analysis, though the fix commit (1ff3c0f) publicly reveals the trigger condition.