---
id: CVE-2026-121727
title: Kore before 4.3.0 Integer Underflow Memory Exhaustion via http_header_recv()
summary: >-
  Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request
  body handling that allows unauthenticated attackers to bypass http_body_max by
  sending more body bytes than declared. Attackers can send oversized first
  segmen…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-191
vendor: jorisvink
product: kore
affected:
  - kore < 4.3.0
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T22:55:33.948Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121727'
references:
  - url: >-
      https://github.com/jorisvink/kore/commit/1ff3c0f6f7973dc7fc8bf38369790ef2d8079b3b
    label: Patch Commit
  - url: 'https://github.com/jorisvink/kore'
  - url: 'https://kore.io/releases/4.3.0'
    label: Kore 4.3.0 Release Notes
  - url: 'https://github.com/jorisvink/kore/blob/4.3.0-rc5/src/http.c#L934'
  - url: >-
      https://www.vulncheck.com/advisories/kore-before-4.3.0-integer-underflow-memory-exhaustion-via-http-header-recv
    label: >-
      VulnCheck Advisory: Kore before 4.3.0 Integer Underflow Memory Exhaustion
      via http_header_recv()
tags:
  - cve.org
epss: 0.00389
epssPercentile: 0.33286
ingestedAt: '2026-11-05T20:33:06.609Z'
---

## Overview

Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass http_body_max by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections, wrapping content_length to grow buffers unbounded and exhaust worker memory.

## Affected

- `kore < 4.3.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.