AirenSoft - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/airensoft/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 28 Oct 2026 22:48:21 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgOvenMediaEngine: Denial of Service via OvtPacket payload_length (CVE-2026-118689)https://feed.craftedsignal.io/briefs/2026-10-ovenmediaengine-dos/Wed, 28 Oct 2026 22:48:21 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-ovenmediaengine-dos/OvenMediaEngine versions up to 0.21.0 are vulnerable to a denial-of-service attack, allowing unauthenticated attackers to exhaust system memory and stall connections by sending crafted OVT packets with excessive payload lengths.OvenMediaEngine versions up to and including 0.21.0 contain a denial of service vulnerability in the OvtPacket::LoadHeader() function. The flaw stems from insufficient validation of the payload_length field within OVT packets. Unauthenticated remote attackers can exploit this by sending packets with a payload_length value exceeding 32750 to the OVT listener. This causes the application to hold the connection open indefinitely and buffer excessive amounts of memory, ultimately disrupting stream relay capabilities.

Impact

Successful exploitation results in a denial-of-service condition where the affected instance can no longer process legitimate stream traffic due to connection exhaustion and memory consumption.

Recommendation

  • Upgrade OvenMediaEngine to a patched version beyond 0.21.0 as soon as a fix is made available by AirenSoft.
  • Until patching, implement network-level egress and ingress filtering to restrict access to the OVT listener port to authorized origin or edge server IPs.
  • Monitor for abnormal connection counts or high memory utilization on servers running OvenMediaEngine.
]]>lowadvisory