CVE-2026-118689— OvenMediaEngine through 0.21.0 OVT Relay DoS via Oversized payload_length

Quick assessment

Affected

OvenMediaLabs OvenMediaEngine

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OvenMediaEngine 0.21.0 及更早版本中存在一个拒绝服务漏洞，位于函数中。该漏洞允许未经身份验证的攻击者通过发送大于 32750 的值，使连接陷入停滞。攻击者可向 OVT 监听器发送特制的 OVT 数据包，从而无限期地保持连接打开状态并持续累积缓冲区内存，最终导致源节点到边缘节点的流媒体中继服务中断。

CVSS 7.5 · High Updated Oct 29, 2026

Possible ATT&CK Techniques 1 AI

T1499.003 · Application Exhaustion Flood

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

OvenMediaEngine through 0.21.0 OVT Relay DoS via Oversized payload_length

Source: CVE Program / CVE List V5

Vulnerability Description

OvenMediaEngine through 0.21.0 contains a denial of service vulnerability in OvtPacket::LoadHeader() that allows unauthenticated attackers to stall connections by sending payload_length values above 32750. Attackers can send crafted OVT packets to the OVT listener to hold connections open indefinitely and accumulate buffered memory, disrupting origin-to-edge stream relay.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

不加限制或调节的资源分配

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
OvenMediaLabs	OvenMediaEngine	0 ~ 0.21.0	-

II. Public POCs for CVE-2026-118689

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-118689

请登录查看更多情报信息。

Other References for CVE-2026-118689 (6)

https://github.com/OvenMediaLabs/OvenMediaEngine product
https://github.com/OvenMediaLabs/OvenMediaEngine/blob/v0.21.0/src/modules/ovt_packetizer/ovt_packet.cpp#L48-L129 technical-description
https://github.com/OvenMediaLabs/OvenMediaEngine/blob/v0.21.0/src/modules/ovt_packetizer/ovt_depacketizer.cpp#L32-L53 technical-description
https://github.com/OvenMediaLabs/OvenMediaEngine/commit/ce316146d668a934217f25c777289ca256aa6786 patch
https://github.com/OvenMediaLabs/OvenMediaEngine/issues/2330 issue-tracking
https://www.vulncheck.com/advisories/ovenmediaengine-through-0.21.0-ovt-relay-dos-via-oversized-payload-length third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-118689

IV. Related Vulnerabilities

Same weakness: CWE-770