Read the docs
TI-2026-84848 Aliases CVE-2026-121727GHSA-f33j-xw62-gm9f

Integer underflow in Kore HTTP body handling exhausts memory

Priority LOW 38CWE-191Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-191 and the CVSS impact.

Summary

Kore before 4.3.0 contains an integer underflow in HTTP request body handling. An unauthenticated remote attacker can send more body bytes than declared to bypass the http_body_max limit, which lets the content_length value wrap and buffers grow without bound. Sending oversized first segments over many concurrent POST, PUT or DELETE connections can exhaust worker memory. The weakness is classified as CWE-191.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass http_body_max by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections, wrapping content_length to grow buffers unbounded and exhaust worker memory.

Why it matters now

EPSS 0.00389 33rd percentileScored 2026-11-07
Fix Fixed kore (jorisvink): 4.3.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
jorisvinkkorebefore 4.3.04.3.0Patch availableCNA
  • kore Vendorjorisvink Affected before 4.3.0 Fixed in 4.3.0 Patch available CNA

Remediation

Upgrade jorisvink kore to version 4.3.0 or later, which fixes the flaw. The sources list no fixed version for Red Hat products beyond the product not being affected.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA kore (jorisvink) Fixed in 4.3.0

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-121727
  2. 2026-11-04 Alias added: GHSA-f33j-xw62-gm9f
  3. 2026-11-05 Priority changed: MEDIUM → LOW
  4. 2026-11-06 Affected versions changed · Red Hat
  5. 2026-11-06 CVSS score added · Red Hat

References

Patch 1

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences