OvenMediaEngine: Denial of service via oversized payload length in OVT relay

Summary

OvenMediaEngine through version 0.21.0 contains a denial-of-service vulnerability in the OVT packet parser (OvtPacket::LoadHeader). An unauthenticated remote attacker can send crafted OVT packets with a payload_length above 32750 to the OVT listener, which keeps connections open indefinitely and accumulates buffered memory. This can disrupt the origin-to-edge stream relay. Only deployments that run the OVT listener and make it reachable from the network are at risk.

Affected

• OvenMediaEngine all versions through 0.21.0
• Relevant only where the OVT listener is enabled and reachable, typically for origin-edge relay

Fixed in

Unknown. No vendor-confirmed fixed version was found. VulDB recommends version 0.21.1 or later, but this could not be verified.

Workaround

• No vendor-confirmed workaround.
• Disable the OVT listener if it is not needed.
• Restrict the OVT ports (default 9000, TLS 9001) to known origin and edge IP addresses at the firewall.
• Apply rate limits and size limits to OVT traffic at network level (generic advice, not verified).

Exploitation

• No known exploitation in the wild reported.
• No public exploit or scanner template indexed as of the OffSeq snapshot.
• Upstream issue #2330 describes the trigger and a reproduction setup publicly, which lowers the effort needed to reproduce the bug.

Our recommendation

• Check whether OvenMediaEngine runs the OVT listener and whether it is reachable from the internet.
• Disable OVT or restrict it to known IP addresses until a fixed version is confirmed.
• Upgrade to the vendor's fixed release once published; check advisory GHSA-c237-3r77-c8g5 and the OvenMediaEngine releases page.
• Monitor connection counts and memory usage of the OvenMediaEngine server.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• VulnCheck advisory for CVE-2026-118689 www.vulncheck.com
• OvenMediaEngine GitHub repository github.com
• OvenMediaEngine issue #2330 github.com
• OvenMediaEngine commit ce316146 github.com
• OvenMediaEngine v0.21.0 ovt_depacketizer.cpp github.com
• VulDB entry for CVE-2026-118689 vuldb.com
• OffSeq Radar entry for CVE-2026-118689 radar.offseq.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:45.