CVE-2026-118689

    Dashboard / Vulnerabilities / CVE-2026-118689

    CVE-2026-118689

    Published: 28 Oct 2026Last Modified: 5 Nov 2026

    Summary: OvenMediaEngine through 0.21.0 OVT Relay DoS via Oversized payload_length

    Details: OvenMediaEngine through 0.21.0 contains a denial of service vulnerability in OvtPacket::LoadHeader() that allows unauthenticated attackers to stall connections by sending payload_length values above 32750. Attackers can send crafted OVT packets to the OVT listener to hold connections open indefinitely and accumulate buffered memory, disrupting origin-to-edge stream relay.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118689.json, https://nvd.nist.gov/vuln/detail/CVE-2026-118689, https://www.vulncheck.com/advisories/ovenmediaengine-through-0.21.0-ovt-relay-dos-via-oversized-payload-length, https://github.com/OvenMediaLabs/OvenMediaEngine/issues/2330, https://github.com/OvenMediaLabs/OvenMediaEngine/commit/ce316146d668a934217f25c777289ca256aa6786, https://github.com/OvenMediaLabs/OvenMediaEngine, https://github.com/OvenMediaLabs/OvenMediaEngine/blob/v0.21.0/src/modules/ovt_packetizer/ovt_depacketizer.cpp#L32-L53, https://github.com/OvenMediaLabs/OvenMediaEngine/blob/v0.21.0/src/modules/ovt_packetizer/ovt_packet.cpp#L48-L129

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -ce316146d668a934217f25c777289ca256aa6786

    Affected versions

    v0.21.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-118689 | CVE-DB