{"id":"CVE-2026-121727","title":"Kore before 4.3.0 Integer Underflow Memory Exhaustion via http_header_recv()","summary":"Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass http_body_max by sending more body bytes than declared. Attackers can send oversized first segmen…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-191"],"vendor":"jorisvink","product":"kore","affected":["kore < 4.3.0"],"published":"2026-11-03","updated":"2026-11-03","sourceUpdated":"2026-11-03T22:55:33.948Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-121727","references":[{"url":"https://github.com/jorisvink/kore/commit/1ff3c0f6f7973dc7fc8bf38369790ef2d8079b3b","label":"Patch Commit"},{"url":"https://github.com/jorisvink/kore"},{"url":"https://kore.io/releases/4.3.0","label":"Kore 4.3.0 Release Notes"},{"url":"https://github.com/jorisvink/kore/blob/4.3.0-rc5/src/http.c#L934"},{"url":"https://www.vulncheck.com/advisories/kore-before-4.3.0-integer-underflow-memory-exhaustion-via-http-header-recv","label":"VulnCheck Advisory: Kore before 4.3.0 Integer Underflow Memory Exhaustion via http_header_recv()"}],"tags":["cve.org"],"epss":0.00389,"epssPercentile":0.33286,"ingestedAt":"2026-11-05T20:33:06.609Z","slug":"CVE-2026-121727","body":"## Overview\n\nKore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass http_body_max by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections, wrapping content_length to grow buffers unbounded and exhaust worker memory.\n\n## Affected\n\n- `kore < 4.3.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}