{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/airensoft/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:airensoft:ovenmediaengine:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-118689"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OvenMediaEngine (\u003c= 0.21.0)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["AirenSoft"],"content_html":"\u003cp\u003eOvenMediaEngine versions up to and including 0.21.0 contain a denial of service vulnerability in the \u003ccode\u003eOvtPacket::LoadHeader()\u003c/code\u003e function. The flaw stems from insufficient validation of the \u003ccode\u003epayload_length\u003c/code\u003e field within OVT packets. Unauthenticated remote attackers can exploit this by sending packets with a \u003ccode\u003epayload_length\u003c/code\u003e value exceeding 32750 to the OVT listener. This causes the application to hold the connection open indefinitely and buffer excessive amounts of memory, ultimately disrupting stream relay capabilities.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a denial-of-service condition where the affected instance can no longer process legitimate stream traffic due to connection exhaustion and memory consumption.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade OvenMediaEngine to a patched version beyond 0.21.0 as soon as a fix is made available by AirenSoft.\u003c/li\u003e\n\u003cli\u003eUntil patching, implement network-level egress and ingress filtering to restrict access to the OVT listener port to authorized origin or edge server IPs.\u003c/li\u003e\n\u003cli\u003eMonitor for abnormal connection counts or high memory utilization on servers running OvenMediaEngine.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-28T22:48:21Z","date_published":"2026-10-28T22:48:21Z","id":"https://feed.craftedsignal.io/briefs/2026-10-ovenmediaengine-dos/","summary":"OvenMediaEngine versions up to 0.21.0 are vulnerable to a denial-of-service attack, allowing unauthenticated attackers to exhaust system memory and stall connections by sending crafted OVT packets with excessive payload lengths.","title":"OvenMediaEngine: Denial of Service via OvtPacket payload_length (CVE-2026-118689)","url":"https://feed.craftedsignal.io/briefs/2026-10-ovenmediaengine-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - AirenSoft","version":"https://jsonfeed.org/version/1.1"}