NVD security advisoryHigh
High advisory for Kore
CVE-2026-121727 · Reported 3 Nov 2026
Full advisory details, affected packages, severity context, and original source.
Affected technology
KoreAffected product
Advisory overview
Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass http_body_max by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections, wrapping content_length to grow buffers unbounded and exhaust worker memory.
Related references
- https://github.com/jorisvink/kore
- https://github.com/jorisvink/kore/blob/4.3.0-rc5/src/http.c#L934
- https://github.com/jorisvink/kore/commit/1ff3c0f6f7973dc7fc8bf38369790ef2d8079b3b
- https://kore.io/releases/4.3.0
- https://www.vulncheck.com/advisories/kore-before-4.3.0-integer-underflow-memory-exhaustion-via-http-header-recv