Denial of Service Vulnerability in OvenMediaEngine by OvenMediaLabs
CVE-2026-118689

8.7HIGH

Key Information:

Vendor

Ovenmedialabs

Status
Ovenmediaengine
Vendor
CVE Published:
28 October 2026

What is CVE-2026-118689?

OvenMediaEngine versions through 0.21.0 are vulnerable to a denial of service attack due to improper handling of oversized payload_length values in OvtPacket::LoadHeader(). Unauthenticated attackers can send specially crafted OVT packets to the OVT listener, causing connections to remain open indefinitely and accumulate excessive buffered memory, which disrupts the stream relay between origin and edge servers. This vulnerability may lead to service interruptions and degradation of the streaming service.

Affected Version(s)

OvenMediaEngine 0 <= 0.21.0

References

https://github.com/OvenMediaLabs/OvenMediaEngine/issues/2330
issue-tracking
https://github.com/OvenMediaLabs/OvenMediaEngine
product
https://github.com/OvenMediaLabs/OvenMediaEngine/blob/v0....
technical-description

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

NoorahSmith
.