CVE-2026-118689: OvenMediaEngine through 0.21.0 OVT Relay DoS via Oversized payload_length
OvenMediaEngine through 0.21.0 contains a denial of service vulnerability in OvtPacket::LoadHeader() that allows unauthenticated attackers to stall connections by sending payloadlength values above 32750. Attackers can send crafted OVT packets to the OVT listener to hold connections open indefinitely and accumulate buffered memory, disrupting origin-to-edge stream relay.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this denial of service?
Deployments running OvenMediaEngine through 0.21.0 with an OVT listener reachable by an attacker are exposed. The described impact is disruption of origin-to-edge stream relay as stalled connections retain buffered memory.
Does exploitation require authentication or user interaction?
No. An unauthenticated attacker can send crafted OVT packets to the OVT listener; no user interaction is required.
What packet characteristic triggers the issue?
The attacker sends an OVT packet with a payload_length value above 32750. This can cause connections to remain stalled indefinitely and accumulate buffered memory.