CVE-2026-118689

OvenMediaEngine through 0.21.0 contains a denial of service vulnerability in OvtPacket::LoadHeader() that allows unauthenticated attackers to stall connections by sending payload_length values above 32750. Attackers can send crafted OVT packets to the OVT listener to hold connections open indefinitely and accumulate buffered memory, disrupting origin-to-edge stream relay.

CVSS 4.0

8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-770

Published

2026-10-28

Modified

2026-10-28

Record from

the NVD, synced 2026-10-28

References

• https://github.com/OvenMediaLabs/OvenMediaEngine
• https://github.com/OvenMediaLabs/OvenMediaEngine/blob/v0.21.0/src/modules/ovt_packetizer/ovt_depacketizer.cpp#L32-L53
• https://github.com/OvenMediaLabs/OvenMediaEngine/blob/v0.21.0/src/modules/ovt_packetizer/ovt_packet.cpp#L48-L129
• https://github.com/OvenMediaLabs/OvenMediaEngine/commit/ce316146d668a934217f25c777289ca256aa6786
• https://github.com/OvenMediaLabs/OvenMediaEngine/issues/2330

Check your stackJSON