Live › vulnerability › CVE-2026-118689
Go to dashboardOvenMediaEngine through 0.21.0 mishandles OVT packet headers in OvtPacket::LoadHeader(), so a payload_length above 32750 leaves the connection waiting indefinitely. An unauthenticated attacker who can reach the OVT listener can hold many connections open and grow buffered memory, disrupting origin-to-edge stream relay.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 22:35 UTC. All times on this page are UTC.
Deployments running OvenMediaEngine 0.21.0 or earlier that expose the OVT listener, typically origin and edge relay setups where the OVT port is reachable from untrusted networks. Installations where the OVT listener is disabled or reachable only from trusted hosts are less exposed. The sources do not say which configurations are default.
No product ranges from the sources yet.
0.21.0.0.21.0; the fixed version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OvenMediaEngine through 0.21.0 contains a denial of service vulnerability in OvtPacket::LoadHeader() that allows unauthenticated attackers to stall connections by sending payload_length values above 32750. Attackers can send crafted OVT packets to the OVT listener to hold connections open indefinitely and accumulate buffered memory, disrupting origin-to-edge stream relay.
This page as .md · .json · in your agent: get_signal("CVE-2026-118689")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.