OvenMediaEngine: Denial of Service via OvtPacket payload_length (CVE-2026-118689)
OvenMediaEngine versions up to 0.21.0 are vulnerable to a denial-of-service attack, allowing unauthenticated attackers to exhaust system memory and stall connections by sending crafted OVT packets with excessive payload lengths.
CVE search metadata
CVE search record: CVE-2026-118689. Severity: high. CVSS: 7.5. KEV: no. Product: OvenMediaEngine (<= 0.21.0). Brief: OvenMediaEngine: Denial of Service via OvtPacket payload_length (CVE-2026-118689). Brief link: https://feed.craftedsignal.io/briefs/2026-10-ovenmediaengine-dos/
Triage facts
Revision 1- Applicability
- OvenMediaEngine (<= 0.21.0)
- Evidence
- Unknown
- Severity
- Low
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 28, 22:48 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
OvenMediaEngine versions up to and including 0.21.0 contain a denial of service vulnerability in the OvtPacket::LoadHeader() function. The flaw stems from insufficient validation of the payload_length field within OVT packets. Unauthenticated remote attackers can exploit this by sending packets with a payload_length value exceeding 32750 to the OVT listener. This causes the application to hold the connection open indefinitely and buffer excessive amounts of memory, ultimately disrupting stream relay capabilities.
Impact
Successful exploitation results in a denial-of-service condition where the affected instance can no longer process legitimate stream traffic due to connection exhaustion and memory consumption.
Recommendation
- Upgrade OvenMediaEngine to a patched version beyond 0.21.0 as soon as a fix is made available by AirenSoft.
- Until patching, implement network-level egress and ingress filtering to restrict access to the OVT listener port to authorized origin or edge server IPs.
- Monitor for abnormal connection counts or high memory utilization on servers running OvenMediaEngine.
Immediate actions
Restrict access to the OVT listener port via firewall rules to known-good infrastructure
Threat Hunt
Identify anomalies in connection duration and memory consumption on OvenMediaEngine servers
Data: Application performance metrics, Server connection tables
Mitigations
Upgrade OvenMediaEngine beyond version 0.21.0 when a vendor patch is released
CVE-2026-118689