Vulnerability · Published Oct 28, 2026 · Assigned by VulnCheck

CVE-2026-118689OvenMediaEngine through 0.21.0 OVT Relay DoS via Oversized payload_length

High 7.5

In plain English

A high-severity resource allocation without limits in OvenMediaEngine from OvenMediaLabs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 56.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

OvenMediaEngine through 0.21.0 contains a denial of service vulnerability in OvtPacket::LoadHeader() that allows unauthenticated attackers to stall connections by sending payload_length values above 32750. Attackers can send crafted OVT packets to the OVT listener to hold connections open indefinitely and accumulate buffered memory, disrupting origin-to-edge stream relay.

Affected products (as reported)

Vendor	Product	Versions
OvenMediaLabs	OvenMediaEngine	0 – through 0.21.0

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

GitHub Issue #2330 issue-tracking
https://github.com/OvenMediaLabs/OvenMediaEngine product
https://github.com/OvenMediaLabs/OvenMediaEngine/blob/v0.21.0/src/modules/ovt_packetizer/ovt_packet.cpp#L48-L129 technical-description
https://github.com/OvenMediaLabs/OvenMediaEngine/blob/v0.21.0/src/modules/ovt_packetizer/ovt_depacketizer.cpp#L32-L53 technical-description
https://github.com/OvenMediaLabs/OvenMediaEngine/commit/ce316146d668a934217f25c777289ca256aa6786 patch
VulnCheck Advisory: OvenMediaEngine through 0.21.0 OVT Relay DoS via Oversized payload_length third-party-advisory