Live › vulnerability › CVE-2026-121727
Kore is a C web application framework whose HTTP request body handling has an integer underflow that lets unauthenticated clients bypass the http_body_max limit. An attacker can send oversized bodies over many concurrent POST, PUT or DELETE connections and exhaust worker memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 23:45 UTC. All times on this page are UTC.
Any service built on Kore before 4.3.0 that accepts HTTP POST, PUT or DELETE requests from the internet is exposed. Services that do not run Kore, or that sit behind a gateway enforcing body size limits, are less exposed; the sources do not say how much a gateway mitigates this.
No product ranges from the sources yet.
4.3.0.http_body_max is set in the Kore configuration; the sources do not say whether the default configuration is affected.4.3.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass http_body_max by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections, wrapping content_length to grow buffers unbounded and exhaust worker memory.
This page as .md · .json · in your agent: get_signal("CVE-2026-121727")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.