Integer Underflow Vulnerability in Kore Web Server by Kore
CVE-2026-121727

8.7HIGH

Key Information:

Vendor

Jorisvink

Status
Kore
Vendor
CVE Published:
3 November 2026

What is CVE-2026-121727?

An integer underflow vulnerability exists in Kore before version 4.3.0, affecting how the server processes HTTP request bodies. This flaw allows unauthenticated attackers to bypass the maximum body size restrictions by sending more bytes than permitted. Exploiting this vulnerability, attackers can dispatch oversized initial segments across multiple concurrent POST, PUT, or DELETE requests, which leads to unbounded buffer growth and potential exhaustion of server memory resources.

Affected Version(s)

kore 0 < 4.3.0

References

https://github.com/jorisvink/kore/commit/1ff3c0f6f7973dc7...
patch
https://github.com/jorisvink/kore
product
https://kore.io/releases/4.3.0
release-notes

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tristan Madani
Joris Vink
.