Vulnerability · Published Nov 3, 2026 · Assigned by VulnCheck
CVE-2026-121727Kore before 4.3.0 Integer Underflow Memory Exhaustion via http_header_recv()
High 7.5
In plain English
A high-severity security flaw in kore from jorisvink. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 66.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass http_body_max by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections, wrapping content_length to grow buffers unbounded and exhaust worker memory.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | kore | no fix listed | DEBIAN-CVE-2026-121727 |
| Debian:14 | kore | no fix listed | DEBIAN-CVE-2026-121727 |
| Ubuntu:22.04:LTS | kore | no fix listed | UBUNTU-CVE-2026-121727 |
| Ubuntu:24.04:LTS | kore | no fix listed | UBUNTU-CVE-2026-121727 |
| Ubuntu:26.04:LTS | kore | no fix listed | UBUNTU-CVE-2026-121727 |
| Ubuntu:26.10 | kore | no fix listed | UBUNTU-CVE-2026-121727 |
Affected products (as reported)
Weakness: CWE-191 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- Patch Commit patch
- https://github.com/jorisvink/kore product
- Kore 4.3.0 Release Notes release-notes
- https://github.com/jorisvink/kore/blob/4.3.0-rc5/src/http.c#L934 technical-description
- VulnCheck Advisory: Kore before 4.3.0 Integer Underflow Memory Exhaustion via http_header_recv() third-party-advisory