CVE-2026-121727

HIGH 7.5

Kore before 4.3.0 Integer Underflow Memory Exhaustion via http_header_recv()

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass http_body_max by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections, wrapping content_length to grow buffers unbounded and exhaust worker memory.

CWE	CWE-191
Vendor	jorisvink
Product	kore
Published	Nov 3, 2026

Stay Ahead of the Next One

Get instant alerts for jorisvink kore

Be the first to know when new high vulnerabilities affecting jorisvink kore are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

jorisvink / kore

0 < 4.3.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/jorisvink/kore/commit/1ff3c0f6f7973dc7fc8bf38369790ef2d8079b3b github.com: https://github.com/jorisvink/kore kore.io: https://kore.io/releases/4.3.0 github.com: https://github.com/jorisvink/kore/blob/4.3.0-rc5/src/http.c#L934 vulncheck.com: https://www.vulncheck.com/advisories/kore-before-4.3.0-integer-underflow-memory-exhaustion-via-http-header-recv

Credits

Tristan Madani Joris Vink