{"id":"CVE-2026-118689","kind":"vulnerability","aliases":["CVE-2026-118689"],"related":[],"title":"OvenMediaEngine: crafted OVT packets stall connections and exhaust memory","description":"OvenMediaEngine through 0.21.0 contains a denial of service vulnerability in OvtPacket::LoadHeader() that allows unauthenticated attackers to stall connections by sending payload_length values above 32750. Attackers can send crafted OVT packets to the OVT listener to hold connections open indefinitely and accumulate buffered memory, disrupting origin-to-edge stream relay.","summary":"OvenMediaEngine through 0.21.0 mishandles OVT packet headers in OvtPacket::LoadHeader(), so a payload_length above 32750 leaves the connection waiting indefinitely. An unauthenticated attacker who can reach the OVT listener can hold many connections open and grow buffered memory, disrupting origin-to-edge stream relay.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["origin-edge","other","ovenmediaengine","self-hosted","streaming"],"not_affected_if":["ovt-listener-disabled","trusted-network-only"],"how_to_check":"- Check the OvenMediaEngine version with the server's version output or package manager, and compare it against `0.21.0`.\n- Check whether the OVT listener (origin-to-edge relay port) is exposed beyond trusted networks in the server configuration.","fix":"- Upgrade OvenMediaEngine to a release later than `0.21.0`; the fixed version is unknown from the sources.\n- Restrict the OVT listener to trusted origin and edge hosts with firewall rules until a fix is applied.","status":"open","published_at":"2026-10-28T22:17:12+00:00","first_seen_at":"2026-10-28T22:35:34+00:00","triaged_at":"2026-10-28T22:36:37+00:00","updated_at":"2026-10-28T22:36:37+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-28T22:36:37Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade OvenMediaEngine to a release later than `0.21.0`; the fixed version is unknown from the sources.\n- Restrict the OVT listener to trusted origin and edge hosts with firewall rules until a fix is applied.","reach":"internet","title":"OvenMediaEngine: crafted OVT packets stall connections and exhaust memory","impact":"medium","summary":"OvenMediaEngine through 0.21.0 mishandles OVT packet headers in OvtPacket::LoadHeader(), so a payload_length above 32750 leaves the connection waiting indefinitely. An unauthenticated attacker who can reach the OVT listener can hold many connections open and grow buffered memory, disrupting origin-to-edge stream relay.","category":"other","nicknames":[],"who_cares":["ovenmediaengine","streaming","self-hosted","origin-edge"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote clients exhaust memory and stall origin-to-edge stream relay","analyst_note":"Find the fixed OvenMediaEngine version and whether the OVT listener is enabled by default, from the NVD entry and the project's release notes.","how_to_check":"- Check the OvenMediaEngine version with the server's version output or package manager, and compare it against `0.21.0`.\n- Check whether the OVT listener (origin-to-edge relay port) is exposed beyond trusted networks in the server configuration.","needs_analyst":true,"not_affected_if":["ovt-listener-disabled","trusted-network-only"],"who_is_affected":"Deployments running OvenMediaEngine 0.21.0 or earlier that expose the OVT listener, typically origin and edge relay setups where the OVT port is reachable from untrusted networks. Installations where the OVT listener is disabled or reachable only from trusted hosts are less exposed. The sources do not say which configurations are default.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000684,"input_tokens":3360,"output_tokens":696,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118689':12A,15A '-2026':11A,14A '0.21.0':27B,73C '32750':40B,96C 'accumul':113C 'allow':84C 'attack':48B,86C,97C 'buffer':62B,114C 'connect':6A,43B,58B,89C,109C 'contain':74C 'craft':2A,100C 'cve':10A,13A 'denial':76C 'disrupt':64B,116C 'edg':18B,68B,120C 'exhaust':8A 'grow':61B 'header':31B 'hold':56B,108C 'host':23B 'indefinit':45B,111C 'leav':41B 'length':38B,93C 'listen':54B,106C 'loadhead':34B,82C 'mani':57B 'memori':9A,63B,115C 'mishandl':28B 'open':59B,110C 'origin':17B,66B,118C 'origin-edg':16B 'origin-to-edg':65B,117C 'ovenmediaengin':1A,20B,25B,71C 'ovt':3A,29B,53B,101C,105C 'ovtpacket':33B,81C 'packet':4A,30B,102C 'payload':37B,92C 'reach':51B 'relay':70B,122C 'self':22B 'self-host':21B 'send':91C,99C 'servic':78C 'stall':5A,88C 'stream':24B,69B,121C 'unauthent':47B,85C 'valu':94C 'vulner':79C 'wait':44B","nicknames":[],"mitigations":[],"who_affected":"Deployments running OvenMediaEngine 0.21.0 or earlier that expose the OVT listener, typically origin and edge relay setups where the OVT port is reachable from untrusted networks. Installations where the OVT listener is disabled or reachable only from trusted hosts are less exposed. The sources do not say which configurations are default.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T22:17:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118689","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118689","severity":null,"published_at":"2026-10-28T22:17:12+00:00","modified_at":"2026-10-28T22:17:12+00:00","first_seen_at":"2026-10-28T22:35:34+00:00","fetched_at":"2026-10-28T22:35:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}